dev/release: explore trusted publishing mechanisms

[lidavidm]

What feature or improvement would you like to see?

Currently we have maintainers deploy release artifacts with API keys, but package indices are encouraging workflows that are more secure and don't depend on this.

[lidavidm]

Also see #3602

[kou]

apache/arrow#44733 (comment) is my conclusion for now:

• We make sure that our artifacts are reproducible
• We can use Trusted Publishing mechanisms provided by packaging systems such as PyPI directly

[lidavidm]

Thanks! Reproducible artifacts seems like it will be the bulk of the work, then

[kou]

FYI: We can use reprotest https://salsa.debian.org/reproducible-builds/reprotest to verify reproducible builds. apache/arrow uses it for deb packages but it must be usable for other packages: https://github.com/apache/arrow/blob/d7d994c0be4893208b0e1d75d420cb99add450f8/.github/workflows/package_linux.yml#L353-L358