Fix incorrect input name for upload-code-coverage action

The docs showed `report:` as the input for the coverage file path,
but the actual action (actions/upload-code-coverage) defines the input
as `file:`. Anyone copy-pasting the documented example would silently
lose their file path since composite actions ignore unrecognized inputs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: joshhale

content/code-security/how-tos/maintain-quality-code/set-up-code-coverage.md

@@ -52,7 +52,7 @@ After your tests generate a Cobertura XML report, upload it to {% data variables
      if: {% raw %}github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository{% endraw %}
      uses: actions/upload-code-coverage@v1
      with:
-       report: COVERAGE-FILE-PATH.xml
+       file: COVERAGE-FILE-PATH.xml
        language: LANGUAGE
        label: LABEL
    ```
@@ -112,7 +112,7 @@ jobs:
         if: {% raw %}github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository{% endraw %}
         uses: actions/upload-code-coverage@v1
         with:
-          report: coverage.xml
+          file: coverage.xml
           language: Python
           label: code-coverage/pytest
 ```