fix: use API token auth for test.pypi.org publish instead of failing OIDC

[Copilot]

The Publish dev package to test.pypi.org job was failing because test.pypi.org has no trusted publisher configured for mother-ml matching the GitHub Actions OIDC claims (sub: repo:Bayer-Group/MotherML:environment:test-pypi).

Change

• Added password: ${{ secrets.TEST_PYPI_API_TOKEN }} to the pypa/gh-action-pypi-publish step, bypassing OIDC entirely in favor of API token auth.

- name: Upload package to Test PyPI
  uses: pypa/gh-action-pypi-publish@release/v1
  with:
    repository-url: https://test.pypi.org/legacy/
    skip-existing: true
    packages-dir: dist/
    password: ${{ secrets.TEST_PYPI_API_TOKEN }}

Required action

Add a test.pypi.org API token scoped to mother-ml as a GitHub secret named TEST_PYPI_API_TOKEN in the test-pypi environment (repository Settings → Environments).