Migrate release workflow to NuGet trusted publishing (OIDC)

[Copilot]

Long-lived NuGet API keys are being phased out in favor of NuGet's trusted publishing, which uses short-lived, OIDC-issued keys scoped to a specific repo and workflow. This updates the release workflow to adopt that mechanism.

• Permissions: added id-token: write (and contents: read) to the workflow so it can request an OIDC token.
• Authentication: replaced the static NUGET_API_KEY secret with a NuGet/login@v1 step that exchanges the OIDC token for a short-lived API key, using a new NUGET_USER secret (nuget.org username).
• Publish step: dotnet nuget push now consumes the short-lived key produced by the login step.

permissions:
  id-token: write
  contents: read

steps:
  - name: NuGet login
    uses: NuGet/login@v1
    id: login
    with:
      user: ${{ secrets.NUGET_USER }}

  - name: PushNuget
    run: dotnet nuget push **/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --skip-duplicate

This requires a Trusted Publishing policy to be configured on nuget.org for this repo and workflow file, along with the NUGET_USER secret, before the old NUGET_API_KEY secret can be removed.