use trusted publisher

[aviramha]

PyPI recently added "Trusted Publisher" concept that allows us to avoid using user-specific access keys.
(I got an email notifying me a token was used instead of that so thought it'd be a good improvement)

[exg]

We already use trusted publishing since 8c90e64 :) I used a token to publish the 1.7.0 release because of an issue in twine and gh-action-pypi-publish that is now resolved (#311 (comment)).

[aviramha]

Whoops!