Use NuGet trusted publishing (OIDC) instead of API key

[IvanMurzak]

Summary

This PR updates the release workflow to use NuGet's trusted publishing feature with OpenID Connect (OIDC) authentication instead of relying on a static API key stored as a secret.

Key Changes

• Added required permissions for OIDC token generation (id-token: write and contents: read)
• Integrated NuGet login step using the official nuget/login@v1 action for OIDC-based authentication
• Removed dependency on NUGET_API_KEY secret from the publish command
• Simplified the NuGet push command by removing the --api-key parameter

Benefits

• Enhanced Security: Eliminates the need to manage long-lived API keys as secrets
• Improved Auditability: OIDC provides better tracking of who/what published packages
• Reduced Attack Surface: Temporary credentials are generated per-workflow run instead of using static secrets
• Industry Standard: Aligns with GitHub's recommended security practices for package publishing

https://claude.ai/code/session_01YJxiyTtL8zDVfF86XuGaZS

[github-actions]

Test Results

    2 files      2 suites   8m 31s ⏱️
1 355 tests 1 355 ✅ 0 💤 0 ❌
2 710 runs  2 710 ✅ 0 💤 0 ❌

Results for commit 089589b.