ci: publish to NuGet via Trusted Publishing, not a long-lived key (#100)

The release job pushed all four Atypical.TechnicalAnalysis* packages with a
NUGET_API_KEY repository secret. It now exchanges the GitHub OIDC token for a
key valid ~1 hour (NuGet/login v1.2.0), so nothing long-lived is stored; the
only remaining secret is NUGET_USER, the nuget.org profile name.

permissions.id-token: write was already declared at workflow level, and the
release job declares no permissions of its own, so it inherits it — no
permission change was needed.

The nuget.org policy must cover all four package ids. Note they are
Atypical.* ids under a phmatray repository, so the policy belongs to whichever
nuget.org account owns those ids, and names phmatray/TaLibStandard regardless.

Author: phmatray

.github/workflows/ci-cd.yml

@@ -177,11 +177,23 @@ jobs:
         skip-commit: true
         output-file: false
 
+    # Trusted Publishing: no long-lived API key. The login step exchanges this workflow's OIDC
+    # token (permissions.id-token: write, declared at workflow level and inherited by this job) for
+    # a NuGet key valid ~1 hour, so it must stay adjacent to the push below. Requires a Trusted
+    # Publishing policy on nuget.org covering all four Atypical.TechnicalAnalysis* ids, naming this
+    # repository and ci-cd.yml, plus the NUGET_USER secret (the nuget.org profile name).
+    - name: NuGet login (OIDC -> short-lived key)
+      id: nuget-login
+      if: steps.should_release.outputs.new_release == 'true'
+      uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push to NuGet
       if: steps.should_release.outputs.new_release == 'true'
       run: |
         dotnet nuget push "./artifacts/*.nupkg" \
-          --api-key "${{ secrets.NUGET_API_KEY }}" \
+          --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \
           --source "https://api.nuget.org/v3/index.json" \
           --skip-duplicate