Add GitHub action to automatically publish to PyPI

[eriknw]

Closes #22.

This uses Trusted Publishing, which needs set up on PyPI and GitHub, which I believe currently needs done by e.g. @stefanv or @jarrodmillman. (Alternatively, I could be added and/or given permission to do this--I have no preference).

Feel free to suggest or update the if: condition for when to upload, as this should probably be done by the release manager and closely match the release process.

Note that I identified two GitHub environments: test-pypi and pypi.

I also updated pre-commit hooks, and made a few changes to make Zizmor pre-commit a little more happy.

Finally, I think it would be nice to upload a release to PyPI, since we are technically name-squatting and could lose it no PyPI without notice. I would do a pre-release first to test the GitHub action.

[agriyakhetarpal]

I know that this is outside the scope of setting up a publishing action, but I wanted to note that this is a TODO lying around outside the diff of this PR, and it'll help secure the publishing process when resolved. So it might make sense to resolve this here itself.

A pre-commit hook is better than an action here, as it'll run in the pre-commit checks job, and you'd avoid adding another action this way.

[agriyakhetarpal]

These permissions can go down into the context of the job, and then this can simply be:

Suggested change

	permissions:
	contents: read
	permissions: {}

so that the permissions are more granularly divided/scoped.

[agriyakhetarpal]

Same as above:

Suggested change

	permissions:
	contents: read
	permissions: {}

[agriyakhetarpal]

Suggested change

	build-artifacts:
	runs-on: ubuntu-latest
	defaults:
	run:
	shell: bash -l {0}
	build-artifacts:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	defaults:
	run:
	shell: bash -l {0}