[CI] Publish packages to NuGet through trusted publishing

[Nice3point]

Summary of the Pull Request

What is this about:

Publishes the NuGet packages with a short-lived key issued through trusted publishing.

Description:

What changed

• The release workflow exchanges a GitHub OIDC token for a one-hour NuGet key and passes it to the build in place of the stored API key.
• The workflow token holds only the permissions the release uses: write access to contents for the GitHub release, read access to packages for the internal feed, and the OIDC token.

Where to look

• The permissions are declared at the workflow level. Every permission left out drops to none, and a future step that calls another GitHub API fails until the block grows.

How verified

• Not run: the workflow runs on a tag push alone, and the next release is the first run.

Open questions

• The trusted publishing policy on nuget.org is temporarily active. A release within its 7-day window locks it to this repository; a release after the window needs the policy reactivated first.
• The NUGET_API_KEY secret stays until the first release passes, and is removed afterwards.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.