ci: use pinned Codecov uploader with OIDC

Author: takemiyamakoto

.github/workflows/codecov.yml

@@ -13,6 +13,9 @@ on:
 jobs:
   build:
     runs-on: macOS-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -168,7 +171,13 @@ jobs:
           fi
 
       - name: Upload coverage to Codecov
-        run: bash <(curl -s https://codecov.io/bash) -J 'fearless'
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          fail_ci_if_error: true
+          plugins: xcode
+          swift_project: fearless
+          use_oidc: true
+          version: v11.3.1
 
   jenkins-pr-merge:
     name: continuous-integration/jenkins/pr-merge