Migrate from API token authentication to trusted publishing for PyPI uploads

[vhaasteren]

Currently, PTMCMCSampler uses traditional API token authentication (PYPI_USERNAME and PYPI_PASSWORD secrets) for PyPI uploads in the GitHub Actions workflow. This approach is less secure and more complex to manage than GitHub's trusted publishing feature.

Current Setup:

• Uses twine upload with stored credentials
• Requires manual management of PyPI API tokens
• Credentials stored in GitHub secrets

Proposed Improvement:

• Migrate to GitHub's trusted publishing using pypa/gh-action-pypi-publish@release/v1
• Use OIDC (OpenID Connect) for authentication
• Remove dependency on stored API credentials

Benefits:

• Enhanced security (no long-lived API tokens)
• Simplified credential management
• Consistent with enterprise and enterprise_extensions packages
• Follows PyPI's recommended authentication method
• Automatic token rotation

Implementation Steps:

1. Configure trusted publishing in PyPI project settings
2. Update GitHub Actions workflow to use pypa/gh-action-pypi-publish
3. Remove TWINE_USERNAME and TWINE_PASSWORD from workflow
4. Add id-token: write permission to workflow
5. Test release process

References:

• PyPI Trusted Publishing Documentation
• GitHub Action for PyPI Publishing