Add OIDC token exchange for NuGet trusted publishing (#34)

The NuGet/login action exchanges the GitHub OIDC token for a
short-lived API key, which is required for trusted publishing to work.

Author: Aaronontheweb

.github/workflows/publish_nuget.yml

@@ -42,10 +42,16 @@ jobs:
     - name: Create Packages
       run:  dotnet pack /p:PackageVersion=${{ github.ref_name }} -c Release -o ./output
 
+    - name: NuGet login (OIDC → temp API key)
+      uses: NuGet/login@v1
+      id: nuget-login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push Packages
       run: |
-        dotnet nuget push "output/*.nupkg" -s https://api.nuget.org/v3/index.json
-        dotnet nuget push "output/*.snupkg" -s https://api.nuget.org/v3/index.json
+        dotnet nuget push "output/*.nupkg" --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
+        dotnet nuget push "output/*.snupkg" --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
 
     - name: "Extract latest release notes"
       shell: pwsh