Improve release security/process for projects

[betatim]

There are a lot of things projects can do to make their release process more secure. We might have a good mix of people with experience in the procedures as well as people who have experience in the individual projects present. This could be a good time to tackle some of the things that improve the release process for projects.

Ideas for things to work on:

• separate release repos a la https://github.com/numpy/numpy-release
• trusted publishing https://docs.pypi.org/trusted-publishers/
• SBOM
• https://scientific-python.org/specs/spec-0008/