Replace WinGet PAT with OIDC trusted publishing

[domenkozar]

Context

#297 adds automated WinGet updates using vedantmgoyal9/winget-releaser. The supported authentication path currently requires a classic GitHub PAT with the public_repo scope stored as WINGET_TOKEN.

Microsoft is tracking an OIDC trusted-publishing proposal in microsoft/winget-pkgs#413785. Once WinGet supports external verified publishers through that flow, SecretSpec should stop using the long-lived PAT.

Done when

• OIDC trusted publishing is available to external WinGet publishers.
• Register cachix/secretspec as a trusted publisher for Cachix.SecretSpec, restricted to the release workflow and appropriate refs/environment.
• Update .github/workflows/winget.yml to request only the required permissions, including id-token: write.
• Replace the secrets.WINGET_TOKEN / classic-PAT path with the supported OIDC submission flow.
• Verify end-to-end that a SecretSpec release creates or updates the expected microsoft/winget-pkgs manifest PR.
• Remove the obsolete WINGET_TOKEN setup instructions from RELEASE.md.
• Delete the WINGET_TOKEN repository secret after the OIDC flow has been verified.

This migration must retain WinGet's existing manifest validation and release-tag filtering.