Releasing Synapse will soon require authenticating via a PyPI API token

This issue has been migrated from [#12268](https://github.com/matrix-org/synapse/issues/12268).

---

When making use of [the release script](https://github.com/matrix-org/synapse/blob/831d4797ab46ada7266046a9719b72ca9e5949f9/scripts-dev/release.py) today and running:

```
./scripts-dev/release.py upload
```

I entered my username and password to upload the package releases of Synapse to PyPI. I then received an email from PyPI telling me:

> ## What?
>
> During your recent upload or upload attempt to PyPI, we noticed you used basic authentication (username & password). However, your account has two-factor authentication (2FA) enabled.
>
>In the near future, PyPI will begin prohibiting uploads using basic authentication for accounts with two-factor authentication enabled. Instead, we will require API tokens to be used.

> ## What should I do?
>
> First, generate an API token for your account or project at https://pypi.org/manage/account/token/. Then, use this token when publishing instead of your username and password. See https://pypi.org/help/#apitoken for help using API tokens to publish.

The release script makes use of the [twine](https://twine.readthedocs.io/en/stable/) tool to upload the packages. As far as I can see, twine does not have a simple option for providing an API token (https://github.com/pypa/twine/issues/561). Instead, one can supply the following at the existing prompt:

```
username: __token__
password: YOUR_PYPI_TOKEN
```

The concrete step here is to update the internal release documentation to note the above workaround. Past that, we can bodge the release script to make this a bit more user-friendly, or simply sit on our laurels until twine release an update with a simplified workflow.