cd: consider replacing 3rd-party GitHub actions

[lukpueh]

Description of issue or feature request:
#1946 adds a CD workflow to release build artifacts on PyPI and GH upon successful completion of the CI workflow for a pushed release tag.

The PR adds 3rd-party actions softprops/action-gh-release and pypa/gh-action-pypi-publish, which goes against our "only allow actions created by GitHub"-policy. It does not seem like a big deal, because the former action is popular and recommended by the archived GitHub-native action/create-release, and the latter is hosted by the PyPA, which also hosts twine, the tool we usually use to publish on PyPI.

We could at least see how hard it would be to implement the required logic for those actions ourselves

Current behavior:
cd.yml uses 3rd-party GitHub actions

Expected behavior:
Assess required effort to replace 3rd-party GitHub actions with custom code, e.g. a shell script that runs twine for pypi uplaod, and a github script that uses octokit to create a release (see custom finalize release action for inspiration for the latter).