Use Trusted Publishers for publishing to PyPI and TestPyPI

### Description & Motivation https://github.com/Lightning-AI/pytorch-lightning/security/advisories/GHSA-w37p-236h-pfx3 / Issue https://github.com/Lightning-AI/pytorch-lightning/issues/21691 would have been avoided if instead of using long-lived PyPI credentials, as is currently done https://github.com/Lightning-AI/pytorch-lightning/blob/0e20e15f2376f4f356470b08875639a945c43334/.github/workflows/release-pkg.yml#L178-L181 https://github.com/Lightning-AI/pytorch-lightning/blob/0e20e15f2376f4f356470b08875639a945c43334/.github/actions/pkg-publish/action.yml#L37-L39 , short-lived tokens through [PyPI Trusted Publishers](https://docs.pypi.org/trusted-publishers/) would be used instead. ### Pitch With no long-lived PyPI token there would be no ability for an attacker to independently publish malicious software to PyPI. To quote from https://docs.pypi.org/trusted-publishers/ > "Trusted Publishing" is our term for using the [OpenID Connect (OIDC)](https://openid.net/connect/) standard to exchange short-lived identity tokens between a trusted third-party service and PyPI. This method can be used in automated environments and eliminates the need to use manually generated API tokens to authenticate with PyPI when publishing. As I'm sure has been communicated to the project by the PyPI security team by now, Trusted Publishers is a strong recommendation to all projects. The project team should follow the [Adding a Trusted Publisher to an existing PyPI project](https://docs.pypi.org/trusted-publishers/adding-a-publisher/) guide. ### Alternatives N/A ### Additional context The security weak point here is moved from PyPI to GitHub and having approved access to the project. This is stronger, but there is still a possible attack vector. So beyond the required MFA that GitHub already enforces, all maintainers should probably increase their security habits on GitHub as well. I'm not sure what the attack was on the `pl-ghost` account, but this is another example of a threat to consider. cc @lantiga