ci: use codecov token when uploading reports

[pichlermarc]

Which problem is this PR solving?

Noticed that all the PR states that the coverage from main is behind. Looks like on main the permissions are not enough to create a new main commit in codecov.

So I'm now passing the token to see if that makes a difference. This is what the Go SIG does:
https://github.com/open-telemetry/opentelemetry-go/blob/8fbaa970843f0899228bc19c1e45a31f5a5bb73e/.github/workflows/ci.yml#L124-L130

See:

• failing upload: https://github.com/open-telemetry/opentelemetry-js/actions/runs/11223167457/job/31197190624#step:9:52
• comment on PR: feat(exporters)!: collapse base classes into one #5031 (comment)

I've noticed the same happening on contrib, where we're hundreds of commits behind. We'll have to do the same there.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93.27%. Comparing base (f8ab559) to head (754bbe2).
Report is 30 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5053      +/-   ##
==========================================
- Coverage   93.39%   93.27%   -0.13%     
==========================================
  Files          46      317     +271     
  Lines         712     8194    +7482     
  Branches      120     1640    +1520     
==========================================
+ Hits          665     7643    +6978     
- Misses         47      551     +504     

see 266 files with indirect coverage changes

[trentm]

LGTM.
Do you know that this repo has a CODECOV_TOKEN secret set? Or perhaps that's at the org level.

[pichlermarc]

LGTM. Do you know that this repo has a CODECOV_TOKEN secret set? Or perhaps that's at the org level.

yep, i checked before opening this PR. It's defined at the org level and inherited by this repo 🙂