ci: add publish workflow for trusted publishing to crates.io (#477)

## Summary
- Add a `workflow_dispatch` workflow to publish Rust crates to crates.io
using OIDC-based trusted publishing (`crates-io-auth-action`)
- Publishes 7 crates in dependency order: `ic-certification`,
`ic-representation-independent-hash`, `ic-cbor`,
`ic-http-certification`, `ic-certificate-verification`,
`ic-asset-certification`, `ic-response-verification`
- Modeled after [dfinity/agent-rs
publish.yml](https://github.com/dfinity/agent-rs/blob/main/.github/workflows/publish.yml)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lwshang

.github/workflows/publish.yml

@@ -0,0 +1,22 @@
+name: Publish to crates.io
+on:
+  workflow_dispatch:
+jobs:
+  publish-crates:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+      - run: |
+          cargo publish -p ic-certification
+          cargo publish -p ic-representation-independent-hash
+          cargo publish -p ic-cbor
+          cargo publish -p ic-http-certification
+          cargo publish -p ic-certificate-verification
+          cargo publish -p ic-asset-certification
+          cargo publish -p ic-response-verification
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}