ci: Use PyPI trusted publisher

This commit updates the CI release workflow to use the PyPI "trusted
publisher" package publishing mechanism.

Signed-off-by: Stephanos Ioannidis <root@stephanos.io>

.github/workflows/release.yml

@@ -14,9 +14,13 @@ jobs:
 
   release:
     name: Release
+    environment: release
     needs: [ ci ]
     runs-on: ubuntu-20.04
 
+    permissions:
+      id-token: write
+
     steps:
     - name: Download build artifacts
       uses: actions/download-artifact@v4
@@ -37,5 +41,4 @@ jobs:
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: assets/