[GHA] Publish and build in separate jobs

[webknjaz]

Hey, I noticed that your workflow for publishing to the PyPI is quite outdated. Please, follow my updated PyPUG guide to set up modern secretless publishing: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/.

Here's a few problematice things that I noticed:

1. python -m build --sdist --wheel invocation. Action item: remove --sdist --wheel, this will give you a smoke test of building sdist from wheel for free
2. Building happens in the same job as publishing — separate them to address the possibility of privilege elevation through the build scripts. Action item: restrict permissions of the job that builds the dists, use GHA artifacts to pass dists between jobs
3. My pypi-publish action version invoked here is @master but it's a years-old release from a deprecated branch. Action item: replace to @release/v1 (or pin to a tag/commit SHA if you'd like Dependabot to bump it for you)
4. The metadata check is called in permissive mode. Action item: add --strict to python -m twine check