chore(ci): use new pypi trusted publisher for increase security

[heitorlessa]

Issue number: #2185

Summary

Updates our release to use new PyPi Trusted Publisher to exchange GHA OIDC token for a valid PyPi token for publishing.

Changes

Please provide a summary of what's being changed

• Update release steps to use new GH Action for PyPi publishing with OIDC
• Remove PyPi token
• Add this repository as a trusted publisher in PyPi prod and PyPi test
• Split build and release jobs for least privilege
• Update release process in-workflow docs

User experience

Please share what the user experience looks like before and after this change

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• Meet tenets criteria
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented
• PR title follows conventional commit semantics

Is this a breaking change?

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[heitorlessa]

cc @rubenfonseca @leandrodamascena - just pending docs but please let me know if you've got any questions.

[rubenfonseca]

Looking at it now.

[rubenfonseca]

Some small things, but amazing job!

[rubenfonseca]

LGTM!