Replace exposed PyPI token with trusted publishing

[Claudio9701]

Security remediation

• removes the workflow dependency on the GhostAction-exposed PYPI_API_TOKEN
• switches from the sunset @master action reference to @release/v1
• scopes OIDC permission to the publishing job
• binds publishing to the pypi GitHub environment

Before the next release, configure the urbanpy project on PyPI with a GitHub Trusted Publisher for owner EL-BID, repository urbanpy, workflow main.yml, environment pypi.

[Copilot]

Pull request overview

This PR remediates release workflow security by removing reliance on a long-lived PyPI API token and switching the deploy job to PyPI Trusted Publishing via GitHub OIDC, scoped to a dedicated pypi environment.

Changes:

• Configure the deploy job to run in the pypi GitHub environment and attach the PyPI project URL.
• Scope job permissions to enable OIDC (id-token: write) for publishing.
• Switch PyPI publish action from a token-based @master reference to pypa/gh-action-pypi-publish@release/v1 (Trusted Publishing).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Claudio9701]

The 0.3 stacked release implementation in #89 supersedes this workflow-only change. Repository Actions secrets PAT, PYPI_API_TOKEN, and TEST_PYPI_API_TOKEN have been removed; only SONAR_HOST_URL and SONAR_TOKEN remain. Please do not merge both implementations. Keep this PR open until the new stack is reviewed, then close it as superseded. PyPI/TestPyPI token revocation and audit-log confirmation are tracked in #99.