.github, ts_python: add GitHub workflow to publish to PyPI

[dylan-tailscale]

Adds a GitHub workflow to build Python 3.12 wheels for Linux (x86_64/ARM64) and macOS (ARM64), then publish them to PyPI for tagged releases. The GitHub repository now has Environments configured for PyPI ("pypi") and Test PyPI ("testpypi") under Settings -> Environments which require approval to deploy to, and both the PyPI and Test PyPI projects for tailscale-py have Trusted Publishers set up with GitHub to allow tokenless publication of wheels from the python.yml workflow.

Confirmed working with Test PyPI; the 0.2.0.post2, 0.2.0.post3, and 0.2.0.post4 releases were published from this workflow, and subsequently yanked. The latest failed publish is intentional, to test attempting to publish a different wheel for an existing release (0.2.0, which was yanked) on testpypi.

Also configures ci.yml to run on tag creation for v* tags.

Closes #43.

[npry]

looks good, nothing blocking

[npry]

Nonblocking: I think you can make this an argument in workflow_dispatch, fwiw

[dylan-tailscale]

Did this, but it appears workflow dispatch vars aren't provided to the workflow unless the workflow itself is on the default branch (?!?). Therefore, I've temporarily made this an env var via env, and commented-out the on.workflow_dispatch.inputs section; once this makes it to main, I'll create a follow-up PR to do this via workflow_dispatch. Wdyt?

[npry]

Nah you don't get the inputs context at all outside of workflow_dispatch and I think workflow_call? I don't believe it'll appear once this is merged, iiuc you just get the dispatch button when that happens, but the restriction about inputs still applies if it's not being triggered that way — you need to pick an alternate value if it's through a tag push or pr. I selected with case in #126

[dylan-tailscale]

@npry probably worth a brief re-review; consolidated and re-arranged a lot based on your comments, added Rust caching, and am going to have to address the GitHub workflow_dispatch tomfoolery in a follow-up. Note the failed publish is intentional - I tried to re-publish 0.2.0 to testpypi, which was yanked. Let me know if you have any issues!

[npry]

along the lines of my reply, I think it won't fix to merge to main? but no harm in merging as is and following up also, either way