[BUG] CLI version defaults to latest

Describe the bug

👋🏾 Howdy! This is partially a feature request but I didn't find a specific template for that. CLI version isn't pinned and defaults to latest, increasing supply chain attack surface and risk of unexpected breaking changes.
We discovered this while troubleshooting code coverage upload failures, the underlying issue appears to have started with CLI 11.2.4 release, and there's an open ticket tracking it: https://github.com/getsentry/prevent-cli/issues/101.

To Reproduce
Steps to reproduce the behavior:

1. Pin codecov-action version without setting the version: input, e.g. uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
2. Monitor the CLI version used

Expected behavior
CLI version is only updated when a new codecov/codecov-action version is released.

Versions

• OS: ubuntu-24.04
• Git Host: GitHub
• CI/CD: GitHub Actions
• Uploader: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1

Commit and CI link
https://github.com/bitwarden/ios/actions/runs/18889125845/job/53913800720

Start with the pinned codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 workflow entry and the linked prevent-cli issue 101 to trace how the CLI version is selected when the version input is omitted. Done means the CLI version remains fixed for a pinned action and changes only when a new codecov-action version is released.