switch pypi publishing to trusted publishers

Author: wseaton

.github/workflows/build.yaml

@@ -142,6 +142,8 @@ jobs:
     needs: [collect-wheels]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -151,6 +153,4 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI }}
           packages_dir: wheels/
-          verify_metadata: false