Update project template cruft, dependencies

Applied updates from upstream project template commits:

2921bf1...45a5e60

*   45a5e60 Merge pull request #113 from smkent/pypi
|\
| * 5a7067d Configure PyPI trusted publishing
|/
*   b1f4625 Merge pull request #112 from smkent/pypi
|\
| * 25c7106 Update `gh-action-pypi-publish` argument names to resolve warnings
|/
*   1e22b05 Merge pull request #111 from smkent/python3.13
|\
| * b8f3c04 Add Python 3.13 to CI jobs
|/
* 51f6060 Merge pull request #110 from smkent/manage-cookie
* 44dc53a Update project template cruft, dependencies

Updated project dependencies via `poetry update`:

Package operations: 0 installs, 1 update, 0 removals

- Updating wrapt (1.17.1 -> 1.17.2)

Writing lock file

Author: smkent

.cruft.json

@@ -1,6 +1,6 @@
 {
   "template": ".",
-  "commit": "2921bf15f3cf22e8e5c9ae04a5f7e8f52daffbc6",
+  "commit": "45a5e60428dab6cb6f6382505d8591a050f1a7ba",
   "context": {
     "cookiecutter": {
       "project_name": "Cookiecutter template for new Python projects",
@@ -13,7 +13,8 @@
       "author_name": "Stephen Kent",
       "author_email": "smkent@smkent.net",
       "github_user": "smkent",
-      "_template": "."
+      "_template": ".",
+      "_commit": "45a5e60428dab6cb6f6382505d8591a050f1a7ba"
     }
   },
   "directory": null,

.github/workflows/cd.yml

@@ -11,14 +11,18 @@ on:
   push:
     tags:
       - '*'
-  workflow_dispatch:
 
 jobs:
   Publish:
     name: Publish package for ${{ github.ref_name }}
 
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/Cookiecutter template for new Python projects
+    permissions:
+      id-token: write
 
     steps:
       - name: 💾 Check out repository
@@ -52,15 +56,12 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         if: ${{ env.ENABLE_TEST_PYPI_PUBLISH == 'true' }}
         with:
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true
 
       - name: ☢️ Publish to PyPI
         if: ${{ env.ENABLE_PYPI_PUBLISH == 'true' }}
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}