Add shasum verification to Codecov Bash Uploader (#6843)

According to https://about.codecov.io/security-update/

tools/coverage/report.sh

@@ -41,4 +41,13 @@ for exec_data in "${JACOCO_HOME}"/*.exec; do
     "${JACOCO_HOME}"/"$exec_data".exec
 done
 
-bash <(curl -s https://codecov.io/bash) -X fix -f /tmp/report-*.xml || true
+# Download codecov bash uploader and verify the sha sums before using it.
+curl -s https://codecov.io/bash > codecov
+VERSION=$(grep -o 'VERSION=\"[0-9\.]*\"' codecov | cut -d'"' -f2)
+for i in 1 256 512
+do
+  shasum -a $i -c --ignore-missing <(curl -s "https://raw.githubusercontent.com/codecov/codecov-bash/${VERSION}/SHA${i}SUM") ||
+  shasum -a $i -c <(curl -s "https://raw.githubusercontent.com/codecov/codecov-bash/${VERSION}/SHA${i}SUM")
+done
+
+bash codecov -X fix -f /tmp/report-*.xml || true