* Don't persist credentials in pypi.yml

Ref: <https://woodruffw.github.io/zizmor/audits/#artipacked>

* Don't persist credentials

This is an insecure default on GitHub that increases the chances of credential leakage.
<https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/>

* Add zizmor exception for RTD pull_request_target trigger

* Create zizmor workflow