Move codecov action to separate pull_request_target workflow

Should mean CI can get green on forked PRs.

.github/workflows/ci.yml

@@ -8,10 +8,6 @@ on:
 
 jobs:
   build:
-    permissions:
-      contents: write
-      id-token: write
-
     runs-on: ubuntu-latest
     continue-on-error: ${{ matrix.experimental }}
     strategy:

.github/workflows/codecov.yml

@@ -0,0 +1,25 @@
+name: Codecov
+
+on:
+  push:
+    branches: [ master ]
+  pull_request_target:
+    branches: [ master ]
+
+jobs:
+  codecov:
+    permissions:
+      id-token: write
+      contents: write
+    runs-on: ubuntu-latest
+    name: Codecov
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - uses: codecov/codecov-action@v4
+        with:
+          use_oidc: true
+