Publish to test.pypi.org; Reduce permission scope of release action

[seifertm]

This PR adds a job that publishes release artifacts to test.pypi.org when merging to main.

It also moves the step for creating a GitHub release into the job that assembles the release notes. This allows removing the id-token: write permission from the GitHub release action and adds the missing contents: write permission.

Fixes #1127

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.01%. Comparing base (f9c5d67) to head (028fc9a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1154   +/-   ##
=======================================
  Coverage   89.01%   89.01%           
=======================================
  Files           2        2           
  Lines         428      428           
  Branches       51       51           
=======================================
  Hits          381      381           
  Misses         33       33           
  Partials       14       14           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.