Add code coverage metrics

[andrewpollock]

It's difficult to reason about the test coverage, so we don't know where we need to improve things, and we don't know what we can confidently modify and release because it has been tested.

[github-actions[bot]]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[andrewpollock]

I note that OSV-Scanner is using Codecov, is it a relatively straightforward exercise to replicate that to this repo?

[another-rex]

I'm not sure how well codecov plays with either python or google cloud build.