Try SLSA setup

[schlenk]

Setup an SLSA attestation and release pipeline to pypi.

• Any changes relevant to users are recorded in the CHANGELOG.md.
• The documentation has been updated, if necessary.
• New code is annotated.
• Changes are covered by tests.

---

This resolves:

#872
#838

As i do not know the current ad-hoc release pipeline, i cannot say if it is enough. Currently it cannot upload anything to pypi as the authorization key on pypi is missing.

I assume we would need to run this against the testpypi first, as documented here:
https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 63.80%. Comparing base (ec242f4) to head (4a04dba).

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #873      +/-   ##
==========================================
- Coverage   63.83%   63.80%   -0.04%     
==========================================
  Files          64       64              
  Lines       11879    11879              
  Branches     2155     2155              
==========================================
- Hits         7583     7579       -4     
- Misses       3693     3697       +4     
  Partials      603      603              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.