Use pypa/gh-actions-pypi-publish for releasing

In order to support trusted publishing.

I believe twine doesn't support it yet, see:

pypa/twine#999

.github/workflows/python-package.yml

@@ -56,19 +56,14 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: startsWith(github.ref, 'refs/tags/v') && success()
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/download-artifact@v3
         with:
           name: dist
           path: dist
-      - uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-      - run: pip install twine
-
-      - name: Publish PyPI package
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
-        run: twine upload dist/*.whl dist/*.tar.gz
+      - uses: pypa/gh-action-pypi-publish@release/v1