Prepare trusted publishing, update core extension

[simolus3]

This updates the core extension to version 0.4.8.

This also adds a bit of build logic to prepare for trusted publishing:

• Because trusted publishing needs to be configured on a specific workflow name, this merges the release and dev-release workflows. The release process happens conditionally based on what triggered the workflow.
• This adds id-token permissions to the publish step, necessary for trusted publishing.
• I've also updated a few actions dependencies.

To actually complete trusted publishing, the package needs to be configured on npm.

[rkistner]

Happy with the publishing changes