ci: publish to NuGet via Trusted Publishing, not a long-lived key

[phmatray]

continuous.yml passed a long-lived NUGET_API_KEY into the Nuke build. It now uses Trusted Publishing: GitHub's OIDC token is exchanged for a NuGet key valid ~1 hour, passed through the same NUGET_API_KEY variable. The only remaining secret is NUGET_USER — the nuget.org profile name, not a credential.

build/Build.cs is unchanged. Nuke reads an environment variable; it neither knows nor cares that the key expires.

The gate matters here, so I matched the build's own

The login step runs only on a version tag. That mirrors what the build already does: Continuous triggers PublishIfNeeded, which is OnlyWhenStatic(IsOnVersionTag() && IsServerBuild) before it ever reaches Publish's Requires(NuGetApiKey). Pushes to main/dev and every pull_request run leave the key unset today and must keep doing so — minting one on a pull request would be pointless, and would fail outright for a fork, which cannot obtain this repository's OIDC token.

Heads-up: this repo's CI is already red, for an unrelated reason

The last three runs fail on NU1902 — AngleSharp 1.4.0 has a known moderate-severity advisory (GHSA-pgww-w46g-26qg) and the build treats it as an error. This PR does not address that and will not go green until AngleSharp is bumped. I left it alone rather than mixing a dependency bump into a credentials change; happy to do it as a separate PR.

Required before the next release

1. Register a Trusted Publishing policy on nuget.org for FormCraft and FormCraft.ForMudBlazor, naming phmatray/FormCraft and continuous.yml.
2. Set the NUGET_USER secret.
3. Cut one release, confirm both packages appear, then delete NUGET_API_KEY.