Switch PyPI release workflow to trusted publishing (PEP 740)

[DeconBear]

This PR updates the release workflow to use PyPI trusted publishing (OIDC) instead of long-lived API tokens.

Changes:

• Add id-token: write permission to the deploy job.
• Replace twine upload with pypa/gh-action-pypi-publish@release/v1.
• Collect wheel/sdist artifacts into dist/ and publish from there.
• Keep existing manual confirmation and non-dev-version checks.

Refs: qutip/qutip#2868

[BoxiLi]

Sorry, this needs to be discussed among the admin maintainers first, and I don't think this script will work by itself because something must be done with PyPI by the project admins.

[Mayank447]

I don't think this script will work by itself because something must be done with PyPI by the project admins.

This is correct, for reference: https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-pypi