Enable codecov coverage checks

[kdacosta0]

Summary

• Adds a GitHub Actions workflow (.github/workflows/code-coverage.yml) that runs Go tests with coverage on every PR and push to main, then uploads the report to Codecov.
• Adds codecov.yml with coverage status thresholds:
  • Patch coverage: 70% target with 5% threshold — new/changed lines in a PR must maintain at least 70% coverage (with 5% tolerance).
  • Project coverage: auto target, informational only — tracks overall project coverage trend without blocking PRs.
• Adds coverage.out to .gitignore to keep the generated coverage artifact out of version control.

Setup Required

CODECOV_TOKEN must be configured as a repository secret in GitHub. Without this token, the Codecov upload step will fail (fail_ci_if_error: true).

Test Plan

• Verify the Code Coverage workflow triggers on PRs targeting main
• Verify coverage.out is listed in .gitignore and not tracked by git
• Verify Codecov receives the coverage report after a successful workflow run
• Verify Codecov PR status checks appear (patch and project)

Implements SECURESIGN-4375