fix(ci): modernize Codecov uploads

[contrueCT]

Purpose of the PR

• close [Bug] Legacy Codecov uploads are silently dropped by tokenless rate limits #3168

HugeGraph still uses codecov/codecov-action@v3 for Commons,
PD/Store/HStore, and Server coverage uploads. Fork pull requests cannot access
CODECOV_TOKEN, so v3 falls back to the legacy anonymous uploader. That
uploader shares a global rate limit: HTTP 429 failures were observed on #3167
and #3161, while the uploader still exited with status 0 and left Codecov with
only a subset of the expected reports.

This PR modernizes the upload boundary only. It does not change JaCoCo
collection, aggregation, coverage thresholds, or production code. The
PD/Store report aggregation work remains independent in #3160 and #3161.

Main Changes

• Upgrade all five repository coverage uploads from
  codecov/codecov-action@v3 to @v5.
• Pass the existing CODECOV_TOKEN for trusted push and same-repository runs.
  On fork pull requests the secret remains unavailable by design, and v5 uses
  its fork-aware tokenless upload path.
• Replace the deprecated file input with files in every upload step.
• Add a repository-wide configuration contract that rejects legacy Codecov
  actions, missing files inputs, missing trusted-run token inputs, removed
  expected uploads, and newly added legacy upload steps.
• Keep Codecov transport errors non-blocking in this PR; this change does not
  add fail_ci_if_error: true.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests, such as (please modify tests here).
• Need tests and can be verified as follows:
  • bash hugegraph-server/hugegraph-dist/src/assembly/travis/test-codecov-upload-config.sh
  • Parse the three changed workflows with SnakeYAML 1.33.
  • mvn -q apache-rat:check -N -ntp
  • mvn editorconfig:check -pl hugegraph-server/hugegraph-dist -am -ntp
  • git diff --check
  • The contract failed against the pre-change v3 configuration and passed
    after all five upload steps were migrated.
  • Mutation checks verified that it rejects a legacy upload in a newly
    added workflow and does not mistake env.token for with.token.

The external upload result is intentionally left to this PR's GitHub Actions
run, which exercises the v5 fork-aware tokenless path that cannot be reproduced
as a local Codecov upload.

Does this PR potentially affect the following parts?

• Dependencies (add/update license info & regenerate_known_dependencies.sh)
• Modify configurations
• The public API
• Other affects (Codecov coverage upload transport and authentication)
• Nope

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.35%. Comparing base (431f6e6) to head (41a60f2).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3169      +/-   ##
============================================
+ Coverage     41.06%   46.35%   +5.28%     
- Complexity      519      706     +187     
============================================
  Files           771      791      +20     
  Lines         65962    67379    +1417     
  Branches       8766     8985     +219     
============================================
+ Hits          27088    31233    +4145     
+ Misses        36008    32945    -3063     
- Partials       2866     3201     +335     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.