Add coverage CI job

[Jakuje]

Description

There is no such nice report like we have in gitlab, but this at least allows running make coverage to get HTML reports to see where we have untested code.

Local run shows to me ok-ish results:

Overall coverage rate:
  lines......: 64.8% (9971 of 15394 lines)
  functions......: 80.3% (771 of 960 functions)
  branches......: 38.3% (4780 of 12476 branches)

and drop leftovers of p11-kit-client.

Checklist

• Code modified for feature
• Test suite updated with functionality tests
• Test suite updated with negative tests
• Documentation updated

Reviewer's checklist:

• Any issues marked for closing are addressed
• There is a test suite reasonably covering new functionality or modifications
• This feature/change has adequate documentation added
• Code conform to coding style that today cannot yet be enforced via the check style test
• Commits have short titles and sensible commit messages
• Coverity Scan has run if needed (code PR) and no new defects were found

[Jakuje]

Report looks reasonable:

https://github.com/latchset/pkcs11-provider/actions/runs/22454953774/job/65033510484?pr=697

Would be great to have HTMLs published somehow, but that might be done separately. We can also put there some automation and differential run to make sure we are not regressing in the coverage.

[simo5]

Unfortunately there does not seem to be any easy way to expose generate files from builds in github :/ But you can archive them as build artifacts that can be downloaded as a tar.gz and displayed in a browser

[simo5]

LGTM

[simo5]

@Jakuje do you want to add support for uploading the coverage THML file as a tar.gz artifact in the actions cache?
If not feel free to merge as is for now.

[Jakuje]

Probably not. I mostly wanted to be able to get this to see where we have dead code and what might need some attention (and have makefile target to be able to run it locally). Given that github does not have a good representation, I think its easier to run it locally than downloading tarballs, but if you prefer, I can add that too.

One though I had would be differential scan to fail if the coverage goes down, but it would need two runs and some regexes. We can also include the tlsfuzzer as I think it has large coverage of odd mechanisms too. That should be quite easy (while slower).

[Jakuje]

I actually did the upload and enabled the tlsfuzzer tests now.

[simo5]

@Jakuje can you rebase this one?

[simo5]

LGTM

[Jakuje]

Rebased