coverage workflows are broken

[joyeecheung]

e.g. see https://github.com/nodejs/node/actions/runs/17024093568 and https://github.com/nodejs/node/actions/runs/17024093573

The SHA pinning of the workflows were enabled yesterday (I am unable to find a public issue about this. It seems to be only discussed in the private TSC slack channel, inspired by a public slack discussion on the nodejs-website room. In retrospect, this should've had a public discussion), and it's currently breaking all the coverage workflows because codecov-action isn't pinning its dependencies: codecov/codecov-action#1858

I propose if by Monday codecov/codecov-action#1859 is still not merged for us to fix it, we revert the setting. When that lands we can flip it back. Opening a public issue for visibility. cc @nodejs/tsc

[joyeecheung]

Note that this seems to still be breaking staging branches. https://github.com/nodejs/node/actions/runs/17040079808 cc @nodejs/releasers