Publish-to-PyPI automated flow

[hemidactylus]

This PR introduces a workflow to bundle the build+publish+release steps as a Github automation.

The advantages are:

1. Lower risk of human mistakes in the process;
2. Everyone with write access to the repo can trigger a release (no need for user-level PyPI access);
3. Improved security with OIDC authentication to PyPI from within a Github runner.

Point 3 means that once this is fully merged, finalized and tested, API keys used so far for publishing the bundle can be revoked, reaching a more controlled security stance.

NOTE
The aim of this PR is to merge a non-finalized process to main, in order to test it from the "real" branch with no actual consequence on PyPI.
Once the tests show it's working as intended, a subsequent PR would finalize the workflow, which means in particular:

• target PyPI for releasing (currently set to target test-PyPI also for the "real" release);
• create a Github release not in draft+pre-release state anymore.

[cbornet]

Comment just to not forget the TODO

[hemidactylus]

Sure :) This is to speed up testing the flow (by a lot!)