ci.yml: add automatic cancellation of current builds if new commits are pushed, and tighten permissions (#1043)

Author: rouault

.github/workflows/ci.yml

@@ -14,6 +14,13 @@ on:
     paths-ignore:
       - '**.md'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 env:
   CCACHE_BASEDIR: ${{ github.workspace }}
   CCACHE_DIR: ${{ github.workspace }}/.ccache