Move package publishing from MyGet to NuGet trusted publishing (#3213)

MyGet stopped accepting our pushes, so drop it entirely rather than fight it: CI now
just builds/tests and surfaces the nbgv-computed version so a release tag can be cut
from it, and a new release.yml (triggered by a published GitHub Release) verifies the
tag against nbgv, then packs and pushes to nuget.org via OIDC trusted publishing. Also
removes appveyor.yml, which was independently deploying to MyGet on every main push.