MAINT: Fix publishing workflow/permissions

[bsipocz]

When I was trying to get 3.5.0 out of the door the publishing workflow is actually run into permission issues. Probably it's just an expired token or similar.

I manually pushed the release out, but ultimately this will need to be fixed (but I didn't think it's something that should actually hold up the release itself).

Digest: sha256:87ea6a78de641247b4d690fb4f9d9e0c270feb3d805facbaf996f3537b5b03e8
Status: Downloaded newer image for ghcr.io/pypa/gh-action-pypi-publish:v1.13.0
Warning: The workflow was run with the 'attestations: true' input, but an explicit password was also set, disabling Trusted Publishing. As a result, the attestations input is ignored.
Warning: Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers
Warning: A new Trusted Publisher for the currently running publishing workflow can be created by accessing the following link(s) while logged-in as an owner of the package(s):
- https://pypi.org/manage/project/sphinx-tabs/settings/publishing/?provider=github&owner=executablebooks&repository=sphinx-tabs&workflow_filename=tests.yml

Checking dist/sphinx_tabs-3.5.0-py3-none-any.whl: PASSED
Checking dist/sphinx_tabs-3.5.0.tar.gz: PASSED
Uploading distributions to https://upload.pypi.org/legacy/
Uploading sphinx_tabs-3.5.0-py3-none-any.whl
WARNING  Error during upload. Retry with the --verbose option for more details. 
ERROR    HTTPError: 403 Forbidden from https://upload.pypi.org/legacy/          
         Invalid or non-existent authentication information. See                
         https://pypi.org/help/#invalid-auth for more information.