revert: hash pinning on pypi publish workflow

[bhearsum]

Missed these ones in #980

(We're already talking about accepting the pinning and loosening the restrictions on the versions of this action that may run; but we may want this to unbreak releases in the meantime.)

[codspeed-hq]

Merging this PR will improve performance by 12.01%

⚡ 1 improved benchmark
✅ 23 untouched benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_transform_sequence	6.8 ms	6.1 ms	+12.01%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing bhearsum:pin2 (1a21cf2) with main (bc32359)}

[ahal]

I went ahead and relaxed the pypi-publish restriction in the settings. After looking into it, I think we should keep the hash pinning.

[ahal]

Outlined my rationale in channel, copy/pasting here:

I think I understand.. The release/v1 branch is like a latest tag.. it points to whatever the latest release on the 1.x branch line is:
https://github.com/pypa/gh-action-pypi-publish/tree/release/v1

but because we're using renovate now, it'll find the tag refs directly.. so it's likely equivalent to using release/v1 but we get to update explicitly instead of implicitly

[bhearsum]

ok, sure

[bhearsum]

#982 for moving back to hash pinning.