Add a GitHub Actions workflow for automatically publishing releases to PyPI

[anoadragon453]

This CI workflow was generated by running maturin generate-ci github (how handy!). But did require a bit of finagling to satisfy the dependency on OpenSSL (boo!). Specifically, I ran into rust-openssl/rust-openssl#2036 (comment). I also found that I needed to set the vendored feature flag on the openssl dependency in order to get building on Linux working.

To authorise to PyPI, we ended up using PyPI's Trusted Publishers feature, which the maturin publish command supports out of the box. This involved configuring this repo and workflow name in PyPI, and then removing the env: MATURIN_PYPI_TOKEN line from the generated CI config (solution referenced here).

I haven't tested this, but given that the config came from the maturin command directly, I have fairly high confidence. After this merges, I'll run the workflow manually on the v0.1.4 tag.

[erikjohnston]

I'm a bit confused why we need to install openssl if we're using vendored openssl? In general I'd rather not use vendored openssl where possible

[anoadragon453]

I agree that it's not the nicest solution to vendor OpenSSL.

I've gone ahead and reverted the vendoring, and while we do install libssl-dev and pkg-config, the openssl-sys crate continues to fail to find the headers.

And for the life of me I can't get it to find them! So very tempted to vendor here.

[erikjohnston]

Do we really want to build wheels for all these targets?

[anoadragon453]

Good point - I think we can safely drop s390x and ppc64le. I've done that in 6221bab.

I'm not sure whether to keep x86 around - some people may realistically still be using it.