Code coverage replacements

[kevinlul]

While coveralls.io still works, the coveralls package is unmaintained and a source of non-production code path security vulnerabilities flagged by Dependabot. This package may not be needed if https://github.com/coverallsapp/github-action is used (removed in 801bf04) on assumption. If it continues to be used, remove the dependency from @alphakretin/mocha-ecosystem and limit the workflow permission as the token is passed to Coveralls.

Alternative: Codecov

• https://about.codecov.io/pricing/
• https://github.com/marketplace/codecov