ci: use CODECOV_TOKEN on protected branch

Author: cuihairu

.github/workflows/ci.yml

@@ -99,8 +99,10 @@ jobs:
           lcov --list coverage.info --rc branch_coverage=1
 
       - name: Upload to Codecov
+        if: github.event_name == 'push'
         uses: codecov/codecov-action@v5
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.info
           fail_ci_if_error: true
           verbose: true