ci: pin Codecov action versions by hash

[spalmurray]

As suggested by @skjnldsv, this PR pins all the codecov actions to commit hashes rather than just versions. Also upgrades some of the invocations to the latest versions. There should be no breaking changes, but we'll see what the CI run does.

Additionally, this adds a check for TESTING=true in the bundle analysis config. I noticed the bundle reports looked very strange in the Codecov app. Some poking around revealed this seems to be due to a weird interaction with cypress tests. For these tests, the environment variable TESTING is set to true, so by disabling bundle uploads when that's the case, we can hopefully avoid this weirdness.

The test analytics dashboard is looking great! It seems to have found a flake and some slow tests: https://app.codecov.io/github/nextcloud/server/tests/master

Let me know if you have any questions!

[spalmurray]

Also @skjnldsv I'm planning to make a PR in https://github.com/nextcloud/.github in the next week or two 🙂

[skjnldsv]

Thank you so much!!

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)