should use Trusted Publishing for PyPI uploads from Github CI

Currently we use an encrypted API token for PyPI uploads.

The recommended approach is using so-called Trusted Publishing which is safer and has a bunch of other benefits, see https://docs.pypi.org/trusted-publishers/

I did that for most of the repo I maintain but since I am not admin on the cffsubr PyPI page I can't do it myself without the Adobe Type team's help.
