Consider switching to PyPI Trusted Publishing

[StevenMaude]

This removes the need for a persistent secret.

Instead, it's instead possible to specify in PyPI that this package is published from this repository, and a short-lived token is requested on publication.