Configure NuGet trusted publishing

[kudima03]

Summary

Switch NuGet publishing from a long-lived NUGET_API_KEY secret to trusted publishing, so the release workflow authenticates to nuget.org with a short-lived OIDC token issued to this repository.

Requires the matching trusted publishing policy to be registered on nuget.org before this is merged.

Changes

• Give the publish-nuget job id-token: write (and contents: read) so it can request an OIDC token
• Add a NuGet login step using NuGet/login@v1
• Push the package with the short-lived key from that step instead of secrets.NUGET_API_KEY

Screenshots

(not applicable)

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
PureQL.CSharp.Model.OpenAPI.Schema	26%	19%	282	➖
Summary	26% (137 / 519)	19% (51 / 266)	282	➖

Minimum allowed line rate is 0%