release machinery: fix attestation and circleci

[ankith26]

In the latest 2.5.1dev2 release we hit a few hiccups with the release machinery

1. The old circleci auto-cancel issue: I have implemented a workaround this time that should (hopefully) work.
2. A new issue where the pypi uploader failed: this is a result of Improve security of releases by adding hash checks #2941 not working as I had expected it to. I have now implemented a new strategy that should serve the same purpose, but works differently. It uses the new github attestations thingy. This time, I'm gonna test out this approach in a separate repo first before merging this PR (I will post links to the status here)

[ankith26]

I made a repo to test what I implemented in this PR: https://github.com/ankith26/testing-attestations

[Starbuck5]

So if I add a new wheel to the GH release before publishing it, the workflow will ignore it?

[ankith26]

Yes, that is the plan. You cannot add or modify any wheel in the github release and then expect the system to release it on PyPI going forward. This is because members have access to the github release and can push arbitrary stuff to it.

If we ever have a requirement of pushing wheels manually, we must now push it to PyPI manually (at the moment only me, you and myre can do it)

[Starbuck5]

Okay let's try it out.