Security Handling for Simplified Workflow

[blink1073]

It turns out that using tag protection doesn't work the way we'd hoped, but we can do the following instead to enforce admin-only publish:

• Use the GITHUB_TOKEN for the workflows and add content:write permission
• Enforce gh.repos.get_collaborator_permission_level(‘$GITHUB_ACTOR’)[‘permission’] is “admin”
• Ensure we use the user name and email of the the $GITHUB_ACTOR to set up the git config

For the shared PyPI credentials, we can create a bot pypi user per org, and add a scoped release token per repo in the org.