Codecov uploads authenticate by OIDC

The `Upload to Codecov` step in `ci.yml` passes `token: ${{ env.CODECOV_TOKEN }}`. `alunduil-chezmoi` uploads with `use_oidc: true` instead, which leaves no upload token to store, rotate, or leak, and `alunduil/zfs-replicate#687` adopts the same. Converging the rest gives the repositories one Codecov pattern.

- [ ] Add `id-token: write` to the coverage job's `permissions` block, alongside the `contents: read` it already needs for checkout.
- [ ] Replace the action's `token:` input with `use_oidc: true`.
- [ ] Decide what replaces the `if: env.CODECOV_TOKEN != ''` guard, which reads a secret that will no longer exist.
- [ ] Delete the `CODECOV_TOKEN` secret once no workflow reads it.

## Additional context

- Reference: the `shell-tests` job in `alunduil-chezmoi`'s `ci.yml`.
- The guard is why this repository needs a decision the others don't. It skips the upload on a fork's pull request, where secrets are withheld. `id-token: write` is withheld there too, since a fork's pull request gets a read-only `GITHUB_TOKEN`, so the skip is still wanted; it just needs a condition that doesn't name the secret, such as testing `github.event.pull_request.head.repo.fork`.
- The secret itself lives wherever `alunduil-infrastructure` manages this repository, so the last item is a change there, not here.