Bump coverage version to resolve signature verification problem

[Czaki]

Our coverage run starts failing with

gpg: Signature made Tue Apr 21 19:28:03 2026 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Can't check signature: No public key
==> Could not verify signature. Please contact Codecov if problem continues
    Exiting...

And v7 release notes is:

v7 of the Codecov GitHub Action bumps the Codecov Wrapper submodule, which now fetches the Codecov Uploader PGP verification key from the codecovsecops Keybase account.