Convert publishing pipeline to Trusted Publishing

[miketheman]

osv.dev/.github/workflows/publish-to-pypi.yaml

Lines 46 to 50 in 408eb3e

	- name: Publish distribution to PyPI
	uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
	with:
	password: ${{ secrets.PYPI_API_TOKEN }}
	packages_dir: dist/

See https://docs.pypi.org/trusted-publishers/

Post-migration, remove the secret from GitHub and PyPI.