Change the package.publish default to false on an edition boundary

[epage]

Problem

For Cargo.toml, package.publish defaults to true.

For "cargo script", package.publish defaults to false.

I also feel like publishing should be more of an explicit choice. especially when working on a workspace where a cargo release (and eventually cargo publish in #1169) can release everything in the workspace.

Proposed Solution

By changing the default, we close the documentation gap between these features.

Notes

See also #6153

[epage]

Came up with a really great alternative to this in #12786: default package.publish based on whether version is set.

[Goffen]

I almost accidentally pushed my crate for my employer to crates.io because I've misunderstood something with the configuration of registry:s

First time publishing a crate should maybe prompt some extra security. Like "Are you sure these files ..... will be uploaded to crates.io/xx/yy" ?!

Thank god I've not configured an access token to crates.io