Disallow manual publishing for packages

[simolus3]

Pub allows publishing a package from GitHub actions. Once automated publishing is enabled and configured, it's still possible to manually pub lish a package outside of actions. In my opinion, that isn't necessary for most packages since all versions would realistically be published through the automation.

So I want to suggest an option to disable publishing without an OIDC token on a per-package basis. This would make pub.dev more resilient to the current npm situation, since stealing a long-lived pub token wouldn't enable an attacker to publish malicious versions of pub packages.

[isoos]

I think we want to do this, but it was not a high priority yet:
#6252

[simolus3]

Missed that issue - thanks!