ci: add unsafe-skipauth tagged-build workflow with coverage

The new SetSkipAuth bypass lives behind the openapi_unsafe_skipauth
build tag; the existing shared go-test workflow has no hook for
matrix-wide build tags, so the tagged path would otherwise rot
silently. Add a dedicated workflow that runs the middleware tests
under the tag on stable + oldstable Go, uploads per-matrix coverage
artifacts, and chains the standard collect-coverage shared job to
push them to codecov.

Modeled after go-openapi/strfmt's integration-test.yml; follows the
runtime workflow conventions (pinned SHAs, blank-line step style,
minimal workflow-level permissions, spaced expressions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Author: fredbi

.codecov.yml

@@ -0,0 +1,9 @@
+codecov:
+  notify:
+    after_n_builds: 2
+
+coverage:
+  status:
+    patch:
+      default:
+        target: 80%

.github/workflows/skipauth-test.yml

@@ -0,0 +1,51 @@
+name: unsafe-skipauth test
+
+permissions:
+  pull-requests: read
+  contents: read
+
+on:
+  push:
+    branches:
+      - master
+
+  pull_request:
+
+jobs:
+  unsafe-skipauth-test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        go-version: [stable, oldstable]
+
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go-version }}
+      -
+        name: Test the dev-mode SetSkipAuth path
+        run: >
+          go test -tags openapi_unsafe_skipauth -race -count=1
+          -coverprofile='skipauth.coverage.ubuntu-latest-${{ matrix.go-version }}.out'
+          -covermode=atomic
+          -coverpkg='github.com/go-openapi/runtime/middleware'
+          ./middleware/...
+      -
+        name: Upload coverage artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          path: 'skipauth.coverage.ubuntu-latest-${{ matrix.go-version }}.out'
+          name: 'skipauth.coverage.ubuntu-latest-${{ matrix.go-version }}'
+          retention-days: 1
+
+  collect-coverage:
+    needs: [unsafe-skipauth-test]
+    if: ${{ !cancelled() && needs.unsafe-skipauth-test.result == 'success' }}
+    uses: go-openapi/ci-workflows/.github/workflows/collect-coverage.yml@7982843ba86a9b47f456a44ed94e82f882b50a8d # v0.2.17
+    secrets: inherit