Generate and upload attestations to PyPI

[hugovk]

PEP 740 ("Index support for digital attestations") introduces digital attestations which links the PyPI package to the GitHub repo, and helps users verify the source and authenticity of packages.

PyPI is still implementing support, but we can already start using it, which should also help them test out.

• https://peps.python.org/pep-0740/
• https://github.com/pypa/gh-action-pypi-publish#generating-and-uploading-attestations
• [Roadmap] Implement PEP 740 pypi/warehouse#15871

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 55.18%. Comparing base (ab26d60) to head (104b4fd).
Report is 13 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #85   +/-   ##
=======================================
  Coverage   55.18%   55.18%           
=======================================
  Files           6        6           
  Lines         453      453           
=======================================
  Hits          250      250           
  Misses        203      203           

Flag	Coverage Δ
macos-latest	55.18% <ø> (+0.22%)	⬆️
ubuntu-latest	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.