CI: Only attempt publish for upstream

[hugovk]

Summary

When updating my fork with upstream, the CI runs pypi-package.yml.

It's good to run the "Build & verify package" job for forks.

But there's no point running the [Test] PyPI upload jobs, because they'll fail because they don't have the credentials set up -- and we wouldn't want to upload from forks anyway.

Error: Trusted publishing exchange failure: 
Token request failed: the server refused the request for the following reasons:

* `invalid-publisher`: valid token, but no corresponding publisher (All lookup strategies exhausted)

This generally indicates a trusted publisher configuration error, but could
also indicate an internal error on GitHub or PyPI's part.

https://github.com/hugovk/attrs/actions/runs/5916632350/job/16044128992

So let's only attempt to publish for the upstream repo:

https://github.com/hugovk/attrs/actions/runs/5916665345

I went for symmetry, but we could probably just do this for release-test-pypi, because it's unlikely a fork will trigger github.event.action == 'published' for release-pypi?

Pull Request Check List

• [n/a] Added tests for changed code.
  Our CI fails if coverage is not 100%.
• [n/a] New features have been added to our Hypothesis testing strategy.
• [n/a] Changes or additions to public APIs are reflected in our type stubs (files ending in .pyi).
  • ...and used in the stub test file tests/typing_example.py.
  • If they've been added to attr/__init__.pyi, they've also been re-imported in attrs/__init__.pyi.
• [n/a] Updated documentation for changed code.
  • New functions/classes have to be added to docs/api.rst by hand.
  • Changes to the signature of @attr.s() have to be added by hand too.
  • Changed/added classes/methods/functions have appropriate versionadded, versionchanged, or deprecated directives.
    The next version is the second number in the current release + 1.
    The first number represents the current year.
    So if the current version on PyPI is 22.2.0, the next version is gonna be 22.3.0.
    If the next version is the first in the new year, it'll be 23.1.0.
• [n/a] Documentation in .rst files is written using semantic newlines.
• Changes (and possible deprecations) have news fragments in changelog.d.
• Consider granting push permissions to the PR branch, so maintainers can fix minor issues themselves without pestering you.

[hynek]

Thanks, symmetry is fine!