chore: stage workflow + package changes for OSS public flip

[Erlend Ellefsen (erlendellefsen)]

Do not merge before the checklist below is complete.

What this changes

• ci-cd.yml: switch publish from private GitHub Packages to NuGet.org. Uses OIDC trusted publishing (matches
  intility/Intility.Logging). Build-and-test job loses its now-unused GitHub Packages auth.
• JsonApiToolkit.csproj: package metadata polish for the nuget.org listing — tightened <Description> to match the README tagline, expanded <PackageTags>, added <PackageProjectUrl>.

Pre-merge checklist

• Configure Actions access for Intility.DotnetApiDocs #147 — Configure Actions access on the Intility.DotnetApiDocs package so intility/json-api-toolkit (public) can read it via GITHUB_TOKEN
• Replace org release bot with repo-level credentials after going public #144 — Replace org release bot creds in release-please.yml with repo-level credentials
• Register intility/json-api-toolkit as trusted publisher on NuGet.org for the Intility.JsonApiToolkit package
• Add NUGET_USER
• Delete NUGET_AUTH_TOKEN repo secret
• Repo flipped to public
• Enable GitHub Private Vulnerability Reporting #143 — Enable Private Vulnerability Reporting (Settings → Code security)
• Verify docs build still succeeds on the now-public repo (sanity check that Configure Actions access for Intility.DotnetApiDocs #147 was wired right)
• Merge this PR

Refs #143, #144, #147