make test: collect coverage only for the main workspace

Every "go test" invocation wrote to the same -coverprofile file, so
the extra runs for vendor/ and the modules under hack/tools overwrote
the profile of the main workspace run. The final profile held only the
coverage of hack/tools/instrumentation. The "go tool cover -html"
step then failed from the repository root, because that module is not
part of the workspace:

  cover: cannot find module providing package
  k8s.io/kubernetes/hack/tools/instrumentation: import lookup
  disabled by -mod=vendor

The failure has kept ci-kubernetes-coverage-unit red on every run
since the extra invocations were added in #137105, and the coverage
data uploaded to testgrid covered only the instrumentation tool
instead of the whole repository.

Pass the coverage flags only to the main workspace invocation.