Add GHA automation for tokenless uploads to PyPI

[webknjaz]

Since the project is pure-python, you can mostly just copy the workflow from my PyPUG guide as is: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#the-whole-ci-cd-workflow. Plus configure trusted publishing on the PyPI side + a GitHub environment in the repo. You can exclude the TestPyPI job (and the testpypi GitHub Environment for that matter) as it's optional.

This will make use of automatic PEP 740 digital attestations with provenance et al. being inspectable.