MNT Rework workflows: split concerns (alternative)

[jeremiedbb]

Alternative version of #16

Closes #13
Closes #14
Closes #15
Toward #6

This PR proposes to rework the workflows to separate the concerns and required permissions. It makes the release workflow closer to what we've been doing so far. It also allows to safely test the wheels from scikit-learn without keeping 2 wheel config in sync.

The release steps would look as follow:

• open the release PR on sklearn. Iterate on the PR, using [cd build] to check the wheels, until it's ready.
  (using [cd build] just calls the build-wheels workflow from this repo, but it can't publish or anything, so it's safe)
  (this way the author of the release PR can iterate and test the wheels, whereas right now we need a maintainer of the release repo to test the wheels against that PR)
• merge the PR and run the publish workflow for the maintenance branch.
  (this workflows calls build-wheels and then publishes to testpypi and pypi in a row)
  • check that everything's fine on test pypi
  • tag the release, then approve the upload to PyPI. It will check that the build about to be published corresponds to the commit that was tagged.

Remark: similar structure as the other PR. The difference is that the publish workflow directly calls build-wheels and uses the artifacts within the job, so no need to loop through previous build workflows.

The nightly builds become:

• scheduled run of the nightly workflow. It uses the build-wheels workflow, then uploads to anaconda.
  (essentially the same as before)
• creates an issue on the main repo on failure, once we've enabled that.
  (commented for now since it requires some setup in sklearn)

Side notes:

• stop uploading to anaconda on merging PRs (that was an oversight of the previous setup)
• run build-wheels on PRs, but not again on pushes to main. That was wasted work.

Follow-up:

• if we merge this we'll need to reconfigure trusted publishers for publish.yml instead of wheels.yml.