ci: authenticate Codecov uploads with OIDC

[rustyconover]

The coverage workflow on main currently completes successfully even though Codecov rejects its upload with Token required because branch is protected. This leaves the repository coverage baseline stale and causes PR patch reports to compare against an old commit.

Configure the Codecov action to use GitHub OIDC, grant the required permissions, and fail the job when an upload is rejected. Fork pull requests continue to use Codecov tokenless uploads because the action detects fork events and skips OIDC for them.

The failed protected-branch upload is visible in https://github.com/apache/arrow-nanoarrow/actions/runs/32611406823.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.30%. Comparing base (f11d517) to head (8b8671e).
⚠️ Report is 81 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #929      +/-   ##
==========================================
- Coverage   79.96%   79.30%   -0.67%     
==========================================
  Files         105      106       +1     
  Lines       15461    16223     +762     
  Branches     1738     1882     +144     
==========================================
+ Hits        12364    12865     +501     
- Misses       1998     2177     +179     
- Partials     1099     1181      +82     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[paleolimbot]

Thank you for this...the codecov setup is wildly out of date.