BLD: deploy.yaml: PyPI trusted publisher support

[richardotis]

This PR adds support for trusted publishing on PyPI using GitHub Actions as an OpenID Connect provider. I have already performed the setup on the PyPI side to allow for this.

After this is merged, we can revoke the dedicated PyPI upload token for pycalphad and use GitHub Actions as our sole deployment tool. We already do this, but this will prevent a leaked token from being able to manipulate release artifacts out-of-band.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.48%. Comparing base (2953e0a) to head (d28313a).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #523   +/-   ##
========================================
  Coverage    90.48%   90.48%           
========================================
  Files           50       50           
  Lines         7880     7880           
========================================
  Hits          7130     7130           
  Misses         750      750           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[richardotis]

The TestPyPI piece can only be tested on a repo branch, so I will merge to see if this works.