Use PyPI trusted publishers integration

[khaeru]

Steps:

1. Make the changes seen in the one commit.
2. Confirm the publish.yaml workflow passes. This means that the correct branch of iiasa/actions is being used, so that the formerly-required "secrets.PYPI_TOKEN" and "secrets.TESTPYPI_TOKEN" are no longer required.
3. Create a tag: git tag v2.9.1dev0 && git push --tags.
4. Confirm the workflow again passes. This results in new files on test.pypi.org, but does not push anything to the production instance, pypi.org.

PR checklist

• Checks all ✅
• Update documentation N/A
• Update doc/whatsnew.rst

[codecov]

Codecov Report

Merging #127 (59bdfb4) into main (d098341) will decrease coverage by 2.43%.
The diff coverage is n/a.

❗ Current head 59bdfb4 differs from pull request most recent head b1245f0. Consider uploading reports for the commit b1245f0 to get more accurate results

@@            Coverage Diff             @@
##             main     #127      +/-   ##
==========================================
- Coverage   98.05%   95.62%   -2.43%     
==========================================
  Files          72       72              
  Lines        5442     5442              
==========================================
- Hits         5336     5204     -132     
- Misses        106      238     +132     

see 16 files with indirect coverage changes