Fix PyPI package upload

[qubvel]

No description provided.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[adamjstewart]

From https://github.com/pypa/gh-action-pypi-publish:

try to separate building from publishing — this makes sure that any scripts maliciously injected into the build or test environment won't be able to elevate privileges while flying under the radar.

This is also how https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ works.

I think we should have separate steps for:

1. Building and uploading artifacts
2. Downloading and publishing artifacts

See https://github.com/microsoft/torchgeo/blob/main/.github/workflows/deploy.yaml for an example.

Also see ultralytics/ultralytics#18027 for some motivation.

[qubvel]

@adamjstewart thanks for bringing this up! I heard about ultrlytics case, 💯 it's better to avoid such situations 😅 would like to make a PR?