Split uploading to PyPI into a separate job

Summary:
This allows us to trigger PyPI uploads from the incoming tag job, rather than
using a crude "this commit matches a tag" workaround.

Test Plan: tox looks happy; needs some testing on actual jenkins

Reviewers: douardda

Differential Revision: https://forge.softwareheritage.org/D711