Fix: add permissions to publish

https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#defining-a-workflow-job-environment i'm not actually sure this is the right location for these permissions

.github/workflows/publish-pypi.yml

@@ -11,6 +11,8 @@ jobs:
     # This ensures that the publish action only runs in the main repository
     # rather than forks
     if: github.repository_owner == 'pyopensci'
+    permissions:
+      id-token: write  # this permission is mandatory for pypi publishing
     steps:
       - name: Checkout
         uses: actions/checkout@v3