Work around Codecov upstream key-import outage

[applesnort]

Summary

• CI's coverage job has intermittently failed on Upload coverage to Codecov with Could not verify signature ... Can't check signature: No public key.
• The action's default CLI download path imports a GPG key from Keybase before verifying the CLI binary. Checked dist/codecov.sh at our pinned SHA (v7.0.0) directly: it fetches from https://keybase.io/codecovsecops/pgp_keys.asc, which resolves fine with a valid key when checked directly right now -- so this looks like a transient failure somewhere in that external retrieval path on the runs that failed, not a permanently dead link.
• (Symptoms and the fix resemble codecov/codecov-action#1955, but that issue's demonstrated cause was a different, since-fixed dead URL on an older version -- same class of Keybase-dependency fragility, not the same bug.)
• use_pypi: true sources the CLI from PyPI instead, skipping the whole key-import/verification path, so it doesn't matter whether that retrieval is having a moment. Note this does bypass Codecov's normal integrity check on the CLI -- an availability fix, not a security-neutral one.
• Not specific to this repo -- a code search turns up ~180 repos in the org using codecov/codecov-action, so likely worth applying elsewhere too, though scope there hasn't been individually confirmed.

Test plan

• Coverage step failed twice on this repo before the change; passed on the first run after it (https://github.com/digitalbazaar/http-client/actions/runs/30176222879)
• YAML validated
• Confirmed https://keybase.io/codecovsecops/pgp_keys.asc (the URL our pinned v7.0.0 actually uses) currently resolves with a valid key

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.06%. Comparing base (8a4adbc) to head (ff95fcb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #55   +/-   ##
=======================================
  Coverage   94.06%   94.06%           
=======================================
  Files           4        4           
  Lines         236      236           
=======================================
  Hits          222      222           
  Misses         14       14           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8a4adbc...ff95fcb. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[davidlehn]

We should wait for them to fix the underlying issue. It's too much churn to fix all our repos like this. Since this isn't all that critical, it's easier to let it fail or rerun until it works.