ci: use deploy-pypi environment

[machow]

This PR moves our pypi-token into a github environment, so we can require review before a github release pushes to pypi.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.73%. Comparing base (f95fcf0) to head (49fcbd4).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #590   +/-   ##
=======================================
  Coverage   90.73%   90.73%           
=======================================
  Files          46       46           
  Lines        5416     5416           
=======================================
  Hits         4914     4914           
  Misses        502      502           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[machow]

Seems to be working as expected:

[rich-iannone]

LGTM

[machow]

Alright, I declined the release review for deploying to pypi, which works well. We should have everything into place so that...

• a CODEOWNER review is required to merge to main
• @machow or @rich-iannone need to review triggered pypi deploys (in workflows)
• people can be given write access, so they can easily preview PR docs / CI