We extend the sdist.yml workflow from #32403 so that it builds sdists for PyPI using make pypi-sdists (from #29039).
This is run on release tags.

When the secret SAGEMATH_PYPI_API_TOKEN exists and the sdists were successfully created, it then proceeds to publish the sdists to PyPI using https://github.com/pypa/gh-action-pypi-publish

At the moment, the secret SAGEMATH_PYPI_API_TOKEN is only available in the repository https://github.com/mkoeppe/sage; in response to a release tag pushed to it, the workflow has successfully built the 9.5.beta6 release sdists (+ this branch): https://github.com/mkoeppe/sage/runs/4200645206?check_suite_focus=true and deployed to PyPI (see, for example https://pypi.org/project/sagemath-standard/9.5b6/)

Later we can move the deployment to https://github.com/sagemath/sage, simply by providing a secret SAGEMATH_PYPI_API_TOKEN to it. (We may want to add a safety check to the workflow that avoids pushing a release that hasn't had a release candidate.)

Depends on #29039
Depends on #32403

CC: @dimpase @jhpalmieri @kiwifb @tobiasdiez

Component: distribution

Author: Matthias Koeppe

Branch: cd51972

Reviewer: Dima Pasechnik

Issue created by migration from https://trac.sagemath.org/ticket/32062