Enable GitHub merge queues

[Zac-HD]

We just got beta access to GitHub merge queues, which are great.

In particular, this will ensure that we no longer have merge conflicts from the window between merging a PR to master and our CD system deploying it and pushing the commit to fix the changelog etc. It also avoids semantic merge conflicts where two PRs pass tests in isolation but fail together, but those haven't been much of a problem for Hypothesis to date. Tasks:

• upgrade internal tooling to handle the magic merge-queue branch prefixes instead of master
• add assertions to break releases etc if merge queues are unexpectedly disabled
• enable merge queues in repo settings and require them with branch-protection rules

[Zac-HD]

PyPI has recently added 'trusted publishers', supporting short-lived and highly secure tokens for publishing. It'd be great to switch over to that too.