fix(ci): modernize Codecov uploads

[contrueCT]

Purpose of the PR

• close [Bug] Legacy Codecov uploads are silently dropped by tokenless rate limits #3168

HugeGraph still uses codecov/codecov-action@v3 for Commons,
PD/Store/HStore, and Server coverage uploads. Fork pull requests cannot access
CODECOV_TOKEN, so v3 falls back to the legacy anonymous uploader. That
uploader shares a global rate limit: HTTP 429 failures were observed on #3167
and #3161, while the uploader still exited with status 0 and left Codecov with
only a subset of the expected reports.

This PR modernizes the upload boundary only. It does not change JaCoCo
collection, aggregation, coverage thresholds, or production code. The
PD/Store report aggregation work remains independent in #3160 and #3161.

Main Changes

• Upgrade all five repository coverage uploads from
  codecov/codecov-action@v3 to @v5.
• Pass the existing CODECOV_TOKEN for trusted push and same-repository runs.
  On fork pull requests the secret remains unavailable by design, and v5 uses
  its fork-aware tokenless upload path.
• Replace the deprecated file input with files in every upload step.
• Add a repository-wide configuration contract that rejects legacy Codecov
  actions, missing files inputs, missing trusted-run token inputs, removed
  expected uploads, and newly added legacy upload steps.
• Keep Codecov transport errors non-blocking in this PR; this change does not
  add fail_ci_if_error: true.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests, such as (please modify tests here).
• Need tests and can be verified as follows:
  • bash hugegraph-server/hugegraph-dist/src/assembly/travis/test-codecov-upload-config.sh
  • Parse the three changed workflows with SnakeYAML 1.33.
  • mvn -q apache-rat:check -N -ntp
  • mvn editorconfig:check -pl hugegraph-server/hugegraph-dist -am -ntp
  • git diff --check
  • The contract failed against the pre-change v3 configuration and passed
    after all five upload steps were migrated.
  • Mutation checks verified that it rejects a legacy upload in a newly
    added workflow and does not mistake env.token for with.token.

The external upload result is intentionally left to this PR's GitHub Actions
run, which exercises the v5 fork-aware tokenless path that cannot be reproduced
as a local Codecov upload.

Does this PR potentially affect the following parts?

• Dependencies (add/update license info & regenerate_known_dependencies.sh)
• Modify configurations
• The public API
• Other affects (Codecov coverage upload transport and authentication)
• Nope

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.44%. Comparing base (5db70c0) to head (424cbc9).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master    #3169       +/-   ##
=============================================
- Coverage     51.16%   37.44%   -13.72%     
- Complexity      264     6448     +6184     
=============================================
  Files           534      800      +266     
  Lines         50665    68595    +17930     
  Branches       7129     9100     +1971     
=============================================
- Hits          25923    25687      -236     
- Misses        21979    39894    +17915     
- Partials       2763     3014      +251     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[imbajin]

Blocking: yes. Summary: The Codecov action upgrade is directionally correct, but this head is not merge-ready after #3161 because it still uses incorrect or over-broad report inputs. Evidence: exact-head jobs 97408972447, 97408972425, and 97406468118 reported missing explicit files and then uploaded unrelated reports; the PR is also currently conflicting with master.

[imbajin]

Verified exact head 424cbc9. All required CI checks pass, and Codecov accepted all 7 expected v5 upload sessions (Commons, PD, Store, HStore, and 3 Server backends); each resolved one explicit report and completed without HTTP 429, missing-file, or upload errors. The red project status (37.44% vs 51.16%) is caused by comparing the complete 7-session head report with an incomplete 3-session base report, not by a missing head upload. Patch coverage is unaffected. Coverage thresholds and JaCoCo aggregation remain outside #3168's scope.