Use PyPI action to publish package

Switch to [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) for the publish to PyPI job in the CI workflow, instead of invocation of `twine upload` (via `tox`), using trusted publishing.

This adds [build artefact attestations](https://docs.pypi.org/attestations/) in the upload to PyPI. Trusted publishing (with attestations) means I can know for certain that what I download from PyPI is the same artefact which was generated in GitHub CI, meaning that what I see in GitHub is the same as what is installed - handy for auditing (rather than having to manually review all of the installed files on each release).

See [the Python packaging documentation](https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#configuring-trusted-publishing), [the PyPI documentation](https://docs.pypi.org/trusted-publishers/), and [the official pypi-publish GitHub action documentation](https://github.com/pypa/gh-action-pypi-publish?tab=readme-ov-file#trusted-publishing) on trusted publishing.

In the `release` job of the [CI workflow](https://github.com/jaraco/keyring/blob/main/.github/workflows/main.yml), you would add the environment and permissions (`id-token: write`), and replace the `Install tox` and `Run` steps with four steps (assuming you don't want to split the build into a separate step, with less permissions):
* install dependencies: `run: pip install build 'jaraco.develop >= 7.1`
* build the package: `run: python -m build`
* the PyPI publish action: `uses: pypa/gh-action-pypi-publish@release/v1` (no `TWINE_PASSWORD` env needed)
* create the GitHub release: `run: python -m jaraco.develop.create-github-release` and `env: { GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} }`

You'll need to configure an environment in PyPI and GitHub. You will be able to remove the `PYPI_USERNAME` project secret.

The `release` tox environment would not be used in CI anymore.

Start with the release job in .github/workflows/main.yml and compare it with the documented pypa/gh-action-pypi-publish trusted-publishing setup. Review the listed PyPI and GitHub environment configuration, then verify the release tox environment is no longer used in CI. Done means the workflow builds and publishes through the action with attestations and creates the GitHub release.

Written by the indexing model from the issue text.