Fix PyPI trusted publishing

[puddly]

I just noticed this in the release CI logs:

Warning: The workflow was run with the 'attestations: true' input, but an explicit password was also set, disabling Trusted Publishing. As a result, the attestations input is ignored.
Warning: Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers
Warning: A new Trusted Publisher for the currently running publishing workflow can be created by accessing the following link(s) while logged-in as an owner of the package(s):

• https://pypi.org/manage/project/zha/settings/publishing/?provider=github&owner=zigpy&repository=zha&workflow_filename=publish-to-pypi.yml

[TheJulianJES]

Yeah, it's been happening since quite a while. We don't use trusted publishing because it's not compatible with our shared workflow (ref: 1 + 2). We could explicitly set attestations: false to suppress the first warning, but it might be a good idea to switch all projects to trusted publishing, even if that means duplicating the PyPi release workflow file across projects.

We may also want to clean up permissions across the PyPi projects a bit for that – some have a bunch of maintainers, but ZHA, for example, only has Dave.