GHA: Use python-pillow/Pillow's Codecov token for own builds

[hugovk]

Currently we're using the Codecov token of python-pillow/Pillow for all builds, including builds in forks. This means we get coverage reports at Codecov from those builds, and fork builds do not get coverage for their own builds.

The Codecov tool can automatically figure out the repo, and a token isn't needed, on Travis CI and AppVeyor, but not yet for GitHub Actions.

So, let's remove the token from the config file.

• Then forks will get their own coverage for Travis and AppVeyor (but not GHA).

• No fork coverage is sent upstream.

But if we're doing a python-pillow/Pillow build on GHA, then first copy a config file containing the token into the root, so we do get GHA coverage.

Once Codecov update to autodetect on GHA, we can remove this workaround.

---

If you do want GHA coverage from your fork builds, fetch your token from https://codecov.io/gh/my-username/Pillow/settings and add it as CODECOV_TOKEN at https://github.com/my-username/Pillow/settings/secrets.

We cannot rely on this secret alone for upstream, because secrets are not available to PRs, and we especially want coverage for PRs.

[hugovk]

Example build from my fork with a token in secrets:

• Coverage for Travis, AppVeyor, GHA

• https://codecov.io/gh/hugovk/Pillow/commit/f7221be2fc50a8217bc395331375eca782d3befe/build

Example build from my fork with no token in secrets:

• Coverage for Travis, AppVeyor (no GHA)

• https://codecov.io/gh/hugovk/Pillow/commit/4a105a82144f98f3dba9d066384ef80dc319f0b3

Neither of these commits show up on CodeCov for upstream:

• https://codecov.io/gh/python-pillow/Pillow/commits

[hugovk]

All green now!

[radarhere]

.github/workflows/codecov-upstream.yml is actually being detected by GHA as a separate job on individual repos.

[hugovk]

Thanks, I've moved it up a level: