[fstagni]

Part of DIRACGrid/.github#5 (PyPI releases / trusted publisher instead of PYPI_TOKEN), same as DIRACGrid/DIRAC#8886.

deploy-pypi is split in two:

• deploy-pypi keeps everything else (release notes, tag, GitHub release, build) and no longer needs any PyPI credential; its permissions are reduced to contents: write (release notes commit + GitHub release). PYPI_API_TOKEN is dropped entirely.
• the new publish job uploads the distribution built by deploy-pypi (passed through an artifact) and publishes it with trusted publishing (environment: pypi, id-token: write), same as already done in diracx, intercede and signurlarity.
• pypa/gh-action-pypi-publish is pinned to the same commit SHA used in the other DIRACGrid repos (it was on the mutable release/v1 branch).

Required follow-ups before the next release (manual):

• create the pypi environment on this repository (no reviewers needed)
• register the trusted publisher on PyPI for the WebAppDIRAC project: workflow deployment.yml, environment pypi, owner DIRACGrid
• verify with a release