[Do not Merge] Migrate PyPI publishing to OIDC Trusted Publishing

[laxmareddyp]

Description of the change

Migrates the PyPI publishing workflow from long-lived API tokens to OIDC Trusted Publishing, eliminating the need for stored secrets (PYPI_API_TOKEN_HUB and PYPI_API_TOKEN).

With Trusted Publishing, GitHub and PyPI exchange short-lived, cryptographically verifiable identity tokens on each release — no manual secret rotation or long-lived credentials required.

Changes

• Added id-token: write permission to allow GitHub to mint OIDC tokens
• Added environment: pypi to the job to match the PyPI Trusted Publisher configuration
• Removed password fields from both pypa/gh-action-pypi-publish steps (keras-hub and keras-nlp)
• Removed # zizmor: ignore[use-trusted-publishing] suppression comments

Follow-up

After a successful OIDC release, remove the unused GitHub Secrets:

• PYPI_API_TOKEN_HUB
• PYPI_API_TOKEN

Resolves the use-trusted-publishing finding from Zizmor (see PR #2792 for the temporary suppression).

Checklist

• I have added all the necessary unit tests for my change.
• I have verified that my change does not break existing code and works with all backends (TensorFlow, JAX, and PyTorch).
• My PR is based on the latest changes of the main branch (if unsure, rebase the code).
• I have followed the Keras Hub Model contribution guidelines in making these changes.
• I have followed the Keras Hub API design guidelines in making these changes.
• I have signed the Contributor License Agreement.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[hertschuh]

Thanks!