CI: setup release artifacts build job and upload with trusted publishing

[dnicolodi]

No description provided.

[rgommers]

I just finished implementing this, as I said I would a few days ago in #710 (comment)

[rgommers]

It's essentially the same: main...rgommers:meson-python:use-trusted-publishing. Differences:

• Runs on PRs to ensure it stays in decent shape (it's low-risk, but still)
• It uses setup-python rather than whatever the python is on the GHA runner image

Feel free to merge them. Yours has a nicer pattern for push: tags:.

[dnicolodi]

Sorry. This is basically copy and paste from another project of mines thus it took very little to put together.

I agree that running on PRs is a good idea. I'd look at the other differences.

[rgommers]

No worries. The only other thing I suggest is to name the deployment env pypi rather than upload for clarity. We may also want to auto-create a GitHub release at some point (although I'm less enthusiastic about the third-party actions that can do that).