security: pin codecov-action to specific commit hash

Pin codecov/codecov-action to commit hash instead of version tag
to address CodeQL warning about unpinned 3rd party actions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: fegge

.github/workflows/test.yml

@@ -35,7 +35,7 @@ jobs:
               run: npm run coverage
 
             - name: Upload coverage to Codecov
-              uses: codecov/codecov-action@v4
+              uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
               with:
                   files: ./coverage/lcov.info
                   fail_ci_if_error: false