ci: Pin PyPI publish action to v1

[auscompgeek]

https://github.com/pypa/gh-action-pypi-publish#-master-branch-sunset-

Also clean up the job:

• Remove the unnecessary checkout and Python setup (the action is in Docker)
• Remove the default user: __token__