coverage workflows are broken #59505

e.g. see https://github.com/nodejs/node/actions/runs/17024093568 and https://github.com/nodejs/node/actions/runs/17024093573

The SHA pinning of the workflows were enabled yesterday (I am unable to find a public issue about this. It seems to be only discussed in the private TSC slack channel, inspired by a public slack discussion on the nodejs-website room. In retrospect, this should've had a public discussion), and it's currently breaking all the coverage workflows because codecov-action isn't pinning its dependencies: codecov/codecov-action#1858

I propose if by Monday codecov/codecov-action#1859 is still not merged for us to fix it, we revert the setting. When that lands we can flip it back. Opening a public issue for visibility. cc @nodejs/tsc