build(deps): bump codecov/codecov-action from 4 to 5 (#1414)

* build(deps): bump codecov/codecov-action from 4 to 5

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 5.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v4...v5)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

* .github: permit keybase.io, which is used by Codecov

Codecov fetches the public key for their uploader from keybase.io,
and this becomes necessary in the v5 action

https://app.stepsecurity.io/github/burningmantech/ranger-ims-server/actions/runs/11993182799?jobid=33433881602&tab=network-events

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sean R. Abraham <[email protected]>

.github/workflows/cicd.yml

@@ -194,6 +194,7 @@ jobs:
             codecov.io:443
             files.pythonhosted.org:443
             github.com:443
+            keybase.io:443
             pypi.org:443
             storage.googleapis.com:443
 
@@ -280,7 +281,7 @@ jobs:
           python-version: 3.13
 
       - name: "Upload coverage to Codecov"
-        uses: "codecov/codecov-action@v4"
+        uses: "codecov/codecov-action@v5"
         if: ${{ matrix.tox-prefix == 'coverage' }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}