coverity: set necessary env vars

Note that I explicitly include the coverity scan token here (unencrypted).
This is because travis doesn't decrypt secure variables for PRs, only for
commits directly to the master repo. We can change the security token in the
coverity scan panel when this PR works. In the mean time, we'll have to ward
of malicious users with arcane incantations.