Bind OIDC publishing to protected environment

Author: chengzeyi

.github/workflows/python-publish.yml

@@ -24,6 +24,7 @@ jobs:
         startsWith(github.ref, 'refs/tags/v')) ||
        (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
     runs-on: ubuntu-latest
+    environment: github-release
     env:
       ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: "true"
     permissions: