ci: concurrency + permissions + SHA-pin hardening (#28)

* ci: add concurrency block to publish.yml

* ci: add minimum permissions to test.yml

Author: hinanohart

.github/workflows/publish.yml

@@ -21,6 +21,10 @@ on:
         required: false
         default: ""
 
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/test.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}