[BUG][docs] Stop suggesting that calling building in the same job as publishing is okay with OIDC enabled

[webknjaz]

I just realized that https://github.com/hynek/build-and-inspect-python-package#usage shows that it's okay to call build tooling in a job that has id-token: write. This is something that we've been trying to discourage since the beginning of TP. I view it as insecure, as mentioned earlier @ #105 (comment).

The fix is to change the example to use two jobs or add a big red warning mentioning the dangers. @woodruffw managed to fix this in GitHub's own docs, after months of waiting for reviews: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-pypi#updating-your-github-actions-workflow / github/docs#32146.

N.B. There's still a PR against GitHub's starter workflows that is taking months to get in: actions/starter-workflows#2345.

[webknjaz]

cc @jamesbraza