use trusted publishers instead of id token

Author: davidzhao

.github/workflows/build-protocol.yml

@@ -90,9 +90,6 @@ jobs:
           path: dist
 
       - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
   docs:
     needs: [publish]