Improve nuget publishing workflow

[roji]

The current Github Actions Nuget publish workflow looks like it publishes any tag to nuget.org, which seems problematic - we should be able to use tags for other purposes as well without a nuget package immediately getting pushed to nuget.org.

At the very least, we should perform the deployment via a Github environment; this environment would require manual authorization for pushing to nuget.org, and would ideally also contain the nuget.org key secret (presumably currently defined in the organization)

@yhmo @weianweigan who would be a good person with permissions to create the Github organization and configure it appropriately?

[weianweigan]

@roji, that sounds good! I looked at the Settings tab but didn't see any environment options. It appears I don't have the necessary permissions to access it. It's possible that only @yhmo has access currently.

[yhmo]

Follow this guideline? https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#creating-an-environment

[yhmo]

An environment is added: