CI: pin actions by commit SHA, replace deprecated codecov test-results action

[indy2kro]

• every action is pinned to the commit SHA of its latest release with the version in a trailing comment (Dependabot keeps both updated):
  • actions/checkout v7.0.1, actions/cache v6.1.0, shivammathur/setup-php 2.37.2, codecov/codecov-action v7.1.1
• codecov/test-results-action is deprecated: test results are now uploaded with codecov-action (report_type: test_results, files: junit.xml)

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.44%. Comparing base (256960d) to head (d194ef4).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #116   +/-   ##
=========================================
  Coverage     96.44%   96.44%           
  Complexity      458      458           
=========================================
  Files            21       21           
  Lines          1069     1069           
=========================================
  Hits           1031     1031           
  Misses           38       38           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.