Enable PyPI Trusted Publishing for supply chain security #74

Hi all
The threema.gateway package is currently uploaded to PyPI via twine with maintainer credentials. PyPI now supports https://docs.pypi.org/trusted-publishers/ — a mechanism that ties uploads cryptographically to a specific GitHub Actions workflow via OIDC, removing the need for long-lived API tokens or passwords.

This would:

• Eliminate the risk of compromised maintainer credentials leading to malicious uploads
• Provide verifiable attestation that a PyPI release was built from a specific commit in this repo
• Align with supply chain security best practices (SLSA, Sigstore)

Especially relevant since threema.gateway handles cryptographic keys and encrypted messaging — downstream consumers (e.g. Home Assistant) benefit from being able to verify the package origin.

Setup is straightforward: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/

Best, LukasQ