build: update trusted publishing

Author: tlambert03

.github/workflows/ci.yml

@@ -76,6 +76,10 @@ jobs:
     if: success() && startsWith(github.ref, 'refs/tags/') && github.event_name != 'schedule'
     runs-on: ubuntu-latest
 
+    permissions:
+      id-token: write  # for trusted publishing on PyPi
+      contents: write  # allows writing releases
+
     steps:
       - uses: actions/checkout@v4
         with:
@@ -93,8 +97,6 @@ jobs:
 
       - name: 🚢 Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.TWINE_API_KEY }}
 
       - uses: softprops/action-gh-release@v1
         with: