Fix security issues with the Trusted Publishing example

https://github.com/simonw/python-lib/blob/4b825ed/%7B%7Bcookiecutter.hyphenated%7D%7D/.github/workflows/publish.yml#L44-L49 suggests that building the dists within the same job that publishes them is okay. But it's not.
Such a structure opens the workflow users to privilege escalation through poisoning the build dependencies, which is why I've always insisted on the separation — the build scripts must never have access to id-token: write.

• https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
• https://docs.pypi.org/trusted-publishers/security-model/

Another suggestion is to fix the GitHub Environment name to represent the deployment target as it's meant to. I usually go for pypi and testpypi so it's obvious that uploading to both is separate.

I saw release here https://github.com/simonw/python-lib/blob/4b825ed/%7B%7Bcookiecutter.hyphenated%7D%7D/.github/workflows/publish.yml#L33C5-L33C25, which is not an upload target but a process name which is very generic.

The declaration syntax can also be extended to include a URL:

-     environment: release
+     environment:
+       name: pypi
+       url: https://pypi.org/project/{% endraw %}{{ cookiecutter.hyphenated }}{% raw %}/${{ github.ref_name }}

Bắt đầu với {{cookiecutter.hyphenated}}/.github/workflows/publish.yml, đặc biệt là các dòng 33 và 44-49, sau đó đọc hướng dẫn PyPI Trusted Publishing được liên kết. Kiểm tra cách các bước build và publish dùng chung quyền, cũng như tên của môi trường release. Công việc được hoàn tất khi workflow tách riêng việc build khỏi việc publish, giữ quyền truy cập vào id-token tách khỏi các script build và đặt tên cho các đích PyPI bằng URL dự án của chúng.