Release packages using trusted publishing

Trusted publishing (with attestations) means I can know for certain that what I download from PyPI is the same artefact which was generated in GitHub CI, meaning that what I see in GitHub is the same as what is installed - handy for auditing (rather than having to manually review all of the installed files on each release).

See [the Python packaging documentation](https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#configuring-trusted-publishing), [the PyPI documentation](https://docs.pypi.org/trusted-publishers/), and [the official pypi-publish GitHub action documentation](https://github.com/pypa/gh-action-pypi-publish?tab=readme-ov-file#trusted-publishing) (for reference only: I'm not suggesting switching to GitHub workflows) on trusted publishing.

It looks like many packages use Azure Dev Ops to publish the package, so the first step will be to make Azure Dev Ops [become a trusted publisher](https://docs.pypi.org/trusted-publishers/internals/#how-do-i-become-a-trusted-publishing-provider).