fix(ci): use allow-listed codecov-action@v4 ref instead of a SHA pin

[demolaf]

No description provided.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

Coverage Report

✅ Coverage 75.48% meets 40% threshold

Total Coverage: 75.48%
Lines Covered: 5208/6900

Package Breakdown

Package	Coverage
firebase_admin_sdk	72.66%
google_cloud_firestore	78.68%

Minimum threshold: 40%

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	-
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[demolaf]

The org's Actions allow-list only permits the literal ref codecov/codecov-action@v4, but this repo's zizmor scan mandates every action be SHA-pinned — and confirmed empirically, the allow-list rejects any SHA for this action, even the exact commit v4 points to.

These two policies directly conflict for this one action; someone with access to either the org allow-list or the zizmor mandatory-checks config needs to grant an exception.