Switch to NuGet trusted publishing

[martincostello]

Once we have access (it's still being progressively rolled-out), we should switch from using API keys to publish packages to NuGet.org to the new Trusted Publishing feature.

This is more secure, and avoids the need to renew/rotate API keys.