Add coverage badge

[eskopp]

Changes

• New job coverage-badge in test.yml (runs on push to main only): runs ./mvnw verify, reads the instruction coverage from the JaCoCo CSV and writes a shields.io endpoint file coverage.json to an orphan branch badges. It only pushes when the value changed. Uses the built-in GITHUB_TOKEN with contents: write for this job only, no external service or secrets.
• README: build status badge and coverage badge.

Notes

• The coverage badge shows up after the first run on main (the badges branch does not exist yet).
• The badges branch must not be deleted by branch cleanups.
• The script and the git logic were tested locally (88% / green, create, update and unchanged against a bare repo).