Harden CI credentialed uploads - #78

Motivation

• Prevent credential exposure to untrusted pull-request code by ensuring SonarCloud and Codecov credentials/OIDC are not available to jobs that execute mvn verify on PR branches.

Description

• Restrict SonarCloud analysis in .github/workflows/quality.yml to run only on trusted push events (change if to github.event_name == 'push').
• Remove job-scoped id-token: write permission from the PR-capable Maven verify job in .github/workflows/maven.yml so that OIDC is not available during PR builds.
• Add a new codecov job in .github/workflows/maven.yml that runs only on push, performs a trusted mvn -B verify there, and then uploads coverage with OIDC; this keeps credentialed uploads isolated to trusted events.

Testing

• Loaded both workflow files with ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "#{f}: ok" }' .github/workflows/quality.yml .github/workflows/maven.yml which succeeded.
• Ran mvn -B -DskipTests validate --file pom.xml which completed with BUILD SUCCESS indicating the project validates after the changes.

Codex Task