Switch NuGet publishing to trusted publishing (OIDC)

[Copilot]

The release workflow published to NuGet.org with a long-lived NUGET_API_KEY secret. This switches it to NuGet's trusted publishing model, using the newly created NUGET_USER secret (the NuGet profile name).

Changes to .github/workflows/release_build.yml

• Added a NuGet/login@v1 step that exchanges the workflow's OIDC token for a short-lived API key.
• Granted the job id-token: write (and explicit contents: read) so OIDC token issuance works.
• dotnet nuget push now consumes the step output instead of the static secret.

- name: NuGet login
  uses: NuGet/login@v1
  id: login
  with:
    user: ${{ secrets.NUGET_USER }}

- name: PushNuget
  run: dotnet nuget push **/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --skip-duplicate

Follow-up once verified: the NUGET_API_KEY repository secret is no longer referenced and can be deleted. A trusted publishing policy for this repo/workflow must exist on the NuGet.org profile for the login step to succeed.

Note: NuGet/login is pinned to the v1 tag to match the existing style of other actions in this workflow; pinning to a commit SHA would be a hardening option if preferred repo-wide.