Generate digital attestations for PyPI (PEP 740)

[hugovk]

PEP 740 ("Index support for digital attestations") introduces signatures which links the PyPI package to the GitHub repo, and helps users verify the source and authenticity of packages.

PyPI is still implementing support, but we can already start using it, which should also help them test out.

• https://peps.python.org/pep-0740/
• https://github.com/pypa/gh-action-pypi-publish#generating-and-uploading-attestations
• [Roadmap] Implement PEP 740 pypi/warehouse#15871

[mdboom]

I don't really know much about the attestations, so I was waiting someone else would come along and review. But this really doesn't seem at all risky, so I'm going to merge.

[hugovk]

Actually, there's no need any more: they flipped the default two days ago :)

https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.11.0

Thanks anyway!