ci: pin codecov action to SHA and add timeout to PR title validation

[askpt]

• Pin codecov/codecov-action from floating @v5 tag to commit SHA
  671740ac38dd9b0130fbe1cec585b89eea48d3de (v5.5.2) for supply chain security
• Add timeout-minutes: 5 to validate_pr_title job to prevent stuck runs

Closes #188

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

CI hardening update for the VS Code extension repo’s GitHub Actions workflows, aligning Codecov with the repo’s supply-chain pinning approach and preventing potential indefinite CI hangs in PR title validation.

Changes:

• Pin codecov/codecov-action from a floating @v5 tag to a specific commit SHA (v5.5.2).
• Add timeout-minutes: 5 to the PR title validation job.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/ci.yml	Pins the Codecov action to a commit SHA to reduce supply-chain risk.
.github/workflows/validate_pr_title.yml	Adds a job timeout to avoid stuck runs consuming runners indefinitely.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.17%. Comparing base (d3d4a1c) to head (a5052f1).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #189   +/-   ##
=======================================
  Coverage   59.17%   59.17%           
=======================================
  Files           6        6           
  Lines        1984     1984           
  Branches      143      143           
=======================================
  Hits         1174     1174           
  Misses        810      810           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.