chore: use trusted publishing action

[ArgoZhang]

Link issues

fixes #39

Summary By Copilot

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

☑️ Self Check before Merge

⚠️ Please check all items below before review. ⚠️

• Doc is updated/provided or not needed
• Demo is updated/provided or not needed
• Merge the latest code from the main branch

[Copilot]

Pull Request Overview

This PR implements trusted publishing for NuGet package deployment by replacing API key authentication with OpenID Connect (OIDC) token-based authentication. This approach enhances security by eliminating the need to store long-lived API keys as secrets.

• Adds OIDC permissions for token-based authentication
• Introduces NuGet login action to obtain temporary API keys
• Updates environment variable source from stored secret to login action output

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Using secrets.NUGET_USER contradicts the purpose of trusted publishing, which is designed to eliminate the need for stored secrets. Trusted publishing should work without any user credentials or API keys stored as secrets.

Suggested change

	with:
	user: ${{ secrets.NUGET_USER }}