ci: publish PHPUnit coverage to GitHub code coverage

- Generate a Cobertura report alongside the existing JUnit report and
  upload it with actions/upload-code-coverage so coverage shows up on
  PRs and the default branch via GitHub's code coverage feature
- Add a step to copy both reports out of the php container before
  publishing them, since var/ is a Docker volume (see the Dockerfile's
  VOLUME /app/var/) and isn't bind-mounted to the runner — this also
  fixes the existing JUnit report publishing step, which was silently
  looking at a path that never had contets on the runner

.github/workflows/ci.yml

@@ -123,6 +123,7 @@ jobs:
       checks: write
       pull-requests: write
       contents: read
+      code-quality: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -150,13 +151,29 @@ jobs:
       - name: Load fixtures
         run: docker compose exec -T php bin/console -e test doctrine:fixtures:load --no-interaction --group=test
       - name: Run PHPUnit
-        run: docker compose exec -T -e MAILER_DSN=null://null php vendor/bin/phpunit --log-junit var/phpunit/junit.xml
+        run: docker compose exec -T -e MAILER_DSN=null://null php vendor/bin/phpunit --log-junit var/phpunit/junit.xml --coverage-cobertura var/coverage/cobertura.xml
+      - name: Copy test reports out of the container
+        # var/ is a Docker volume (see Dockerfile's VOLUME /app/var/), not bind-mounted to the
+        # runner, so reports written there by PHPUnit must be copied out explicitly.
+        if: always()
+        continue-on-error: true
+        run: |
+          mkdir -p var/phpunit var/coverage
+          docker compose cp php:/app/var/phpunit/junit.xml var/phpunit/junit.xml
+          docker compose cp php:/app/var/coverage/cobertura.xml var/coverage/cobertura.xml
       - name: Publish PHPUnit test results
         if: always()
         uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6
         with:
           report_paths: var/phpunit/junit.xml
           check_name: PHPUnit
+      - name: Upload code coverage
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/upload-code-coverage@82c7aee3fb2ad768e00b00a0a8d749c5815085b6 # v1
+        with:
+          file: var/coverage/cobertura.xml
+          language: PHP
+          label: phpunit
       - name: Doctrine Schema Validator
         run: docker compose exec -T php bin/console -e test doctrine:schema:validate