Set up trusted publishing to PyPI

[weiji14]

Some annotation warnings from https://github.com/xarray-contrib/cupy-xarray/actions/runs/23076335791/attempts/1#summary-67037324927:

Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers

I don't have access to PyPI (https://pypi.org/project/cupy-xarray/), so can someone add me or set it up by going to https://pypi.org/manage/project/cupy-xarray/settings/publishing/?provider=github&owner=xarray-contrib&repository=cupy-xarray&workflow_filename=pypi-release.yaml? Set the 'Environment name:' to pypi (lowercase) and I can update the workflow.

References:

• https://docs.pypi.org/trusted-publishers/adding-a-publisher
• https://docs.zizmor.sh/audits/#use-trusted-publishing