How exercise of independent third party secure source code review is
different from penetration testing?
The secure code review is a white-box methodology where the code reviewer will be using automated tools and/or manual approach to identify security issues in the the given source code whereas, penetration testing is mostly a black-box methodology where the organisation will only provide only the IP address or name/URL of the application under test. In the penetration test the security analyst usually starts with information gathering and will then identify the vulnerabilities in the system. Later, the analyst will attack the system under test and will try to penetrate deeper and deeper so as to identify more security issues and to evaluate the impact of the identified vulnerabilities.
What are limitations of independent third party secure source code
review and penetration testing and do they cover each other where they
It purely depends on the type of engagement with your vendor. Mostly, they don't cover each other. I personally recommend both penetration test and secure code review on the application. Secure code review is more of a static approach. Although, modern secure code review tools offers dynamic capabilities such as taint analysis where the data in motion is also analysed but again my personal experience says that secure code review can never accomplish the results of penetration test and vice versa.
What areas independent third party secure source code review covers
which penetration testing doesn't and vice versa?
As already stated, both of the approach can be used to achieve better results. I hope I can explain it better using an example. For an instance, server-side secure code review will include the password management checks. In the scenario where a weak hashing algorithm such as MD5 is used to hash the user's password. This security issue will be identified in secure code review where the issue may not be identified in a penetration test if the server/code access is not attained.