[ci] enforce zizmor checks, drop codecov

[jameslamb]

Proposing a couple of security-related changes:

• dropping codecov
• enforcing zizmor checks (GitHub Actions pinned to SHAs, protections against script injection, limiting permissions, etc.)

Notes for Reviewers

Also proposing doing the following manual steps after this is merged:

• remove codecov integration from the repo
• set an allowlist of GitHub Actions third-party workflows