chore(ci): switch to trusted PyPI publishing

https://docs.pypi.org/trusted-publishers/

Author: scop

.github/workflows/main.yml

@@ -48,12 +48,12 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       - uses: casperdcl/deploy-pypi@928e3123266d588b46c017228f9a9d4c13ad4c93 # v2.5.0
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
           build: true
           # only upload if a tag is pushed (otherwise just build & check)
           upload: ${{ github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags') }}