Non-PR hooks can trigger builds in which the CODEBUILD_SOURCE_VERSION
would be populated as the commit SHA. Our current logic dictates that
that commit SHA would be passed onto CodeCov as the PR number, which
would always be an invalid value (must be a number, true, or falsy).

This updates the logic so that it will ensure that the environment
variable being checked actually matches the "pr/" pattern before trying
to use it. If it does not, it will return undefined.

Dealing with security fix and windows test.

Verify source version before parsing PR

Bumps [acorn](https://github.com/acornjs/acorn) from 5.7.3 to 5.7.4.
- [Release notes](https://github.com/acornjs/acorn/releases)
- [Commits](acornjs/acorn@5.7.3...5.7.4)

Signed-off-by: dependabot[bot] <[email protected]>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Codecov recently did some fundamental storage changes on its backend in an effort to greatly improve the reliability of our underlying storage systems. As a result the `X-Amz-Acl: public-read` header is no longer needed, and may result in 400 errors if used. 

You can see a similar fix in codecov-python that removes that header here: https://github.com/codecov/codecov-python/pull/253/files