Trusted Publishing

Support for [Trusted Publishing](https://repos.openssf.org/trusted-publishers-for-all-package-repositories) has become quite common among major package repositories, for example:
* [PyPI](https://docs.pypi.org/trusted-publishers/)
* [npm](https://docs.npmjs.com/trusted-publishers)
* [crates.io](https://crates.io/docs/trusted-publishing)

The benefits are well described in [Why Trusted Publishers](https://repos.openssf.org/trusted-publishers-for-all-package-repositories#why-trusted-publishers). For Hackage specifically:

* *Security*. The tokens issued by Hackage have unbounded lifetime and have overly broad permissions (capable of uploading to any package the user maintains). The trusted publishing model uses short-lived tokens which are tied to source repository and workflow.
* *Maintainer convenience*. Trusted publishing can be configured once in a set-and-forget fashion and should be more convenient than manually managing secrets. Support for trusted publishing could be integrated into existing workflows such as [haskell-actions/hackage-publish](https://github.com/haskell-actions/hackage-publish) for turn-key release automation.