Add layer of security to conda and pip uploading

[brynpickering]

Adding a few more gates to publishing packages on public indexes:

1. Move github secrets to environments. These can have many more security checks associated with them, namely requiring a fixed set of individuals to manually approve a workflow run when it is triggered. This mitigates bad actors opening pull requests that leverage the upload tokens for PyPI / anaconda.
2. Triple check that the pip package being uploaded will successfully install. Although we already have the test-pypi check, I recently discovered that if you upload to test-pypi and then find out something is wrong, you can't scrub test-PyPI of that version. This means you effectively have to bump the version number even though you haven't actually uploaded to PyPI yet.

I realise package uploading is small fry at the moment, with only PAM making use of it. However, as we open up more packages and clean up existing open ones, there will be more of our work being published to package indexes (indices?).

[mfitz]

👍

[brynpickering]

Pre-release and release successful in a boilerplate repo.