…12257)

This commit updates CI config and such to ensure that we're compatible
with crates.io-based trusted publishing. Eventually we'll want the
restriction that only `wasmtime-publish` is the user on all of our
crates, but for now this needs to land and get backported before that's
done.

Changes here are:

* The `publish-to-cratesio.yml` workflow now uses
  `rust-lang/crates-io-auth-action@v1` to get a crates.io-based token.
  The in-repository secret is no longer used.
* The `publish-to-cratesio.yml` workflow has a new github "Environment"
  it runs in named `publish`
* The publish script no longer adds the
  `github:bytecodealliance:wasmtime-publish` user to crates.
* The publish script now verifies that the `wasmtime-publish` github
  users is on all crates.
* Eventually the publish script will verify that it's the only user on
  all the crates, but that's left for a future PR.

External changes are:

* A new `publish` "Environment" was added to this repository.
* All crates are configured on crates.io to have a trusted publishing
  workflow for this repository.
* All crates now require being published through a trusted publishing
  workflow.

My plan is to backport this to the 40.0.0 branch, run a point release,
fix anything that comes up, and then backport this to all supported
branches of Wasmtime.