Consider option to disable manual publishing

[jonasfj]

As part of credential-less publishing we could consider disabling manual publishing.

Essentially having a checkbox that disallows publishing from the commandline authenticated using a Google user account.

Thus, allowing package admins to force publishing to go through github actions or GCP service accounts.

This could just be a bit in the section for automated publishing configuration.

---

We could also consider coming up with a migration plan to stop storing a refresh token on the developers machine. But if we just allow package authors to disable publishing using the refresh_token flow, then that might not be necessary.

---

@isoos, @sigurdm, @szakarias, thoughts?

[isoos]

Maybe this could be another property of a discontinued package: publishing is disabled for all publishing agents.

[sigurdm]

I think having a bit on the package sounds like a good idea.
We could also consider keeping a bit (or even more info) on each version telling how it was published - it seems like that might be relevant for presenting some kind of providence claim later. Of course we have to be careful we don't store private info here.

Maybe this could be another property of a discontinued package: publishing is disabled for all publishing agents.

Hmm - I would think it is common to mark a package discontinued, and then push an update that explains the situation in the README... that would be annoying.