feat(cli): add trustpub subcommand

[yihau]

What does this PR try to resolve?

It already supports the trusted publishing token scope and API, but it looks like Cargo doesn't support it yet.

How to test and review this PR?

I used the owner command as a template and added this new command.

Command	API Call
cargo trustpub list [--crate foo]	GET /api/v1/trusted_publishing/github_configs?crate=foo
cargo trustpub add --owner O --repo R --pipeline ci.yml [--env E]	POST /api/v1/trusted_publishing/github_configs
cargo trustpub remove --id 42	DELETE /api/v1/trusted_publishing/github_configs/42
cargo trustpub set --trustpub-only true	PATCH /api/v1/crates/foo {"crate":{"trustpub_only":true}}

there are 2 global args

• crate (falls back to the current package)
• token

below is what these commands look like with some use cases

cargo trustpub --help

  Manage Trusted Publishing configuration for a crate on the registry

  Usage: cargo trustpub [OPTIONS] <COMMAND>

  Commands:
    list    List the Trusted Publishing configs for a crate
    add     Add a GitHub Actions Trusted Publishing config to a crate
    remove  Remove a Trusted Publishing config from a crate
    set     Control whether new versions must be published via Trusted Publishing

  Options:
        --crate <CRATE>            Crate to operate on
        --token <TOKEN>            API token to use when authenticating
    -v, --verbose...               Use verbose output (-vv very verbose/build.rs output)
    -q, --quiet                    Do not print cargo log messages
        --color <WHEN>             Coloring [possible values: auto, always, never]
        --config <KEY=VALUE|PATH>  Override a configuration value
    -Z <FLAG>                      Unstable (nightly-only) flags to Cargo, see 'cargo -Z help' for
                                   details
    -h, --help                     Print help

  Manifest Options:
        --locked   Assert that `Cargo.lock` will remain unchanged
        --offline  Run without accessing the network
        --frozen   Equivalent to specifying both --locked and --offline

cargo trustpub list --help

  List the Trusted Publishing configs for a crate

  Usage: cargo trustpub list [OPTIONS]

  Options:
        --crate <CRATE>            Crate to operate on
        --token <TOKEN>            API token to use when authenticating
    -v, --verbose...               Use verbose output (-vv very verbose/build.rs output)
    -q, --quiet                    Do not print cargo log messages
        --color <WHEN>             Coloring [possible values: auto, always, never]
        --config <KEY=VALUE|PATH>  Override a configuration value
    -Z <FLAG>                      Unstable (nightly-only) flags to Cargo, see 'cargo -Z help' for
                                   details
    -h, --help                     Print help

  Manifest Options:
        --locked   Assert that `Cargo.lock` will remain unchanged
        --offline  Run without accessing the network
        --frozen   Equivalent to specifying both --locked and --offline

cargo trustpub --token _TOKEN_ list [--crate ruleset-playground]

    Updating crates.io index
10684: github org101org101/ruleset-playground workflow=release.yml environment=prod
10685: github org101org101/ruleset-playground workflow=release.yml

cargo trustpub add --help

  Add a GitHub Actions Trusted Publishing config to a crate

  Usage: cargo trustpub add [OPTIONS] --owner <OWNER> --repo <REPO> --pipeline <PIPELINE>

  Options:
        --crate <CRATE>            Crate to operate on
        --owner <OWNER>            GitHub repository owner (user or organization)
        --repo <REPO>              GitHub repository name
        --token <TOKEN>            API token to use when authenticating
        --pipeline <PIPELINE>      GitHub Actions workflow filename (e.g. `ci.yml`)
        --env <ENV>                GitHub Actions environment the workflow must run in
    -v, --verbose...               Use verbose output (-vv very verbose/build.rs output)
    -q, --quiet                    Do not print cargo log messages
        --color <WHEN>             Coloring [possible values: auto, always, never]
        --config <KEY=VALUE|PATH>  Override a configuration value
    -Z <FLAG>                      Unstable (nightly-only) flags to Cargo, see 'cargo -Z help' for
                                   details
    -h, --help                     Print help

  Manifest Options:
        --locked   Assert that `Cargo.lock` will remain unchanged
        --offline  Run without accessing the network
        --frozen   Equivalent to specifying both --locked and --offline

cargo trustpub --token _TOKEN_ add [--crate ruleset-playground] --owner org101org101 --repo ruleset-playground --pipeline release.yml

    Updating crates.io index
       Added trusted publishing config 10690 (org101org101/ruleset-playground workflow=release.yml) for crate `ruleset-playground`

cargo trustpub --token _TOKEN_ add [--crate ruleset-playground] --owner org101org101 --repo ruleset-playground --pipeline release.yml --env prod

    Updating crates.io index
       Added trusted publishing config 10715 (org101org101/ruleset-playground workflow=release.yml environment=prod) for crate `ruleset-playground`

cargo trustpub remove --help

  Remove a Trusted Publishing config from a crate

  Usage: cargo trustpub remove [OPTIONS] --id <ID>

  Options:
        --crate <CRATE>            Crate to operate on
        --id <ID>                  Id of the config to remove (see `cargo trustpub list`)
        --token <TOKEN>            API token to use when authenticating
    -v, --verbose...               Use verbose output (-vv very verbose/build.rs output)
    -q, --quiet                    Do not print cargo log messages
        --color <WHEN>             Coloring [possible values: auto, always, never]
        --config <KEY=VALUE|PATH>  Override a configuration value
    -Z <FLAG>                      Unstable (nightly-only) flags to Cargo, see 'cargo -Z help' for
                                   details
    -h, --help                     Print help

  Manifest Options:
        --locked   Assert that `Cargo.lock` will remain unchanged
        --offline  Run without accessing the network
        --frozen   Equivalent to specifying both --locked and --offline

cargo trustpub --token _TOKEN_ remove --id 10691

    Updating crates.io index
     Removed trusted publishing config 10691 for crate `ruleset-playground`

cargo trustpub set --help

  Control whether new versions must be published via Trusted Publishing

  Usage: cargo trustpub set [OPTIONS] --trustpub-only <BOOL>

  Options:
        --crate <CRATE>            Crate to operate on
        --trustpub-only <BOOL>     Require Trusted Publishing for new versions of the crate [possible
                                   values: true, false]
        --token <TOKEN>            API token to use when authenticating
    -v, --verbose...               Use verbose output (-vv very verbose/build.rs output)
    -q, --quiet                    Do not print cargo log messages
        --color <WHEN>             Coloring [possible values: auto, always, never]
        --config <KEY=VALUE|PATH>  Override a configuration value
    -Z <FLAG>                      Unstable (nightly-only) flags to Cargo, see 'cargo -Z help' for
                                   details
    -h, --help                     Print help

  Manifest Options:
        --locked   Assert that `Cargo.lock` will remain unchanged
        --offline  Run without accessing the network
        --frozen   Equivalent to specifying both --locked and --offline

cargo trustpub --token _TOKEN_ set --trustpub-only true

    Updating crates.io index
     Updated `trustpub_only` for crate `ruleset-playground` to true

[rustbot]

Thanks for the pull request, and welcome! The Rust Project is excited to review your changes, and you should hear from @epage (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

• @rustbot author: the review is finished, PR author should check the comments and take action accordingly
• @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

Why was this reviewer chosen?

The reviewer was selected based on:

• Owners of files modified in this PR: @ehuss, @epage, @weihanglo
• @ehuss, @epage, @weihanglo expanded to ehuss, epage, weihanglo
• Random selection from ehuss, epage, weihanglo

[epage]

Moving this to a draft as the problem, requirements, and a high level design have not been discussed and accepted by the cargo team in an issue per our contrib guide

[rustbot]

☔ The latest upstream changes (possibly #17230) made this pull request unmergeable. Please resolve the merge conflicts.