configure trusted publishing

[willkg]

Currently, @willkg is the only one able to publish releases to PyPI. We should set up trusted publishing.

https://docs.pypi.org/trusted-publishers/adding-a-publisher/