Allow scoped tokens with rights for multiple projects

[ronaldoussoren]

What's the problem this feature will solve?
I have a project (PyObjC) that generates multiple PyPI distributions/projects from a single source base. This is both for historical reasons and because a single repo makes development easier.

API tokens are currently suboptimal for this, I need to create either:

• A user-scoped token for my normal user
• A user-scoped token for a new user with limited rights
• Multiple project-scoped tokens

Describe the solution you'd like
It would be nice if it were possible to create a project-scoped token that's scoped to multiple projects.

Additional context
See above.

Note that this should IMHO have low priority, the work around with a new user with limited rights is workable for me.

[woodruffw]

This is actually supported on the backend (see V1Caveat.verify_projects); we just don't expose it via the token creation form yet. Would be relatively easy to implement.

[Sterbic]

Looking into this for the PyCon AU sprints

[di]

We may need to think a bit about what the UI would look like here before trying to implement this. The current UI (just a select box) would not easily support this.

[Sterbic]

I went with the simplest possible multi selector in #6373 but happy to look at other solutions as well.

[woodruffw]

Triage: this is covered transitively via Trusted Publishing, i.e. configuring the same Trusted Publisher for multiple projects.