redo publishing workflow

[briantist]

Resolves #70

• splits the release job into 3 separate jobs
  • the main reason for this is to give least permission to each of the job types
  • the job types are "container" (build and push to ghcr), "pypi" (publish to pypi), and "github" (creating the release page)
• the pypi publish now uses OIDC (trusted publisher) integration, so once confirmed working I can revoke the token I generated and remove that secret from the repo settings

[codecov]

Codecov Report

Patch coverage has no change and project coverage change: -0.11 ⚠️

Comparison is base (95a604f) 56.70% compared to head (f7e499a) 56.59%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #73      +/-   ##
==========================================
- Coverage   56.70%   56.59%   -0.11%     
==========================================
  Files          26       26              
  Lines         947      947              
==========================================
- Hits          537      536       -1     
- Misses        410      411       +1     

see 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.