Description of the problem

The publish-to-pypi.yml workflow uploads the PyGMT packages to PyPI and/or TestPyPI.

During the release v0.3.0, we found an issue with the workflow and had a quick fix in #900.

When I reiviwed the workflow, I found two more issues:

1. We're using secrets test_pypi_password and pypi_password in the pypa/gh-action-pypi-publish action.
   

   pygmt/.github/workflows/publish-to-pypi.yml

   Lines 54 to 64 in 65b099a

   	- name: Publish to Test PyPI
   	uses: pypa/gh-action-pypi-publish@v1.4.2
   	with:
   	password: ${{ secrets.test_pypi_password }}
   	repository_url: https://test.pypi.org/legacy/
   	- name: Publish to PyPI
   	if: startsWith(github.ref, 'refs/tags')
   	uses: pypa/gh-action-pypi-publish@v1.4.2
   	with:
   	password: ${{ secrets.pypi_password }}

The names of these two secrets are confusing. They are API tokens (generated by me, if I remember correctly), not someone's passwords. We should rename them to better names, TEST_PYPI_API_TOKEN and PYPI_API_TOKEN following the official guide.

2. The workflow always fails on forks, because forks don't have these secrets. We should skip the workflow for forks.