[ci] remove codecov, enforce zizmor checks

[jameslamb]

Proposes a batch of security fixes:

• removes codecov (I'll click the buttons to revoke the app's access once this is merged)
• enforces zizmor checks

Notes for Reviewers

I also made some manual changes at https://github.com/uptake/uptasticsearch/settings/actions

• only allow third-party actions matching an allowlist in the repo's settings
• default all workflow permissions to read-only
• require approval for CI to run for first-time contributors

[jameslamb]

Ok other than the known issue from #265 , this is working.

[austin3dickey]

Looks awesome, thank you! TIL zizmor

[austin3dickey]

oooh this is a great idea! I'll probably steal this for other workflows!

[jameslamb]

it's pretty nice! New as of last Fall: https://github.blog/changelog/2025-09-18-actions-yaml-anchors-and-non-public-workflow-templates/

[jameslamb]

TIL zizmor

Thanks for looking, yeah it's great!

It's taught me new things about how GitHub Actions works and it's really well-done. I want to use it in every repo I use GitHub Actions in.

[jameslamb]

Looks like I don't have permissions to deactivate the project at https://app.codecov.io/gh/uptake/uptasticsearch

But that's ok... it isn't installed as a GitHub App on the repo. So I think this is done.

Goodbye codecov, it was real while it lasted.