ci: address CodeRabbit review findings

- Add permissions: contents: read (least-privilege GITHUB_TOKEN)
- Add persist-credentials: false to all checkout steps
- Add concurrency group to cancel superseded CI runs
- Fix pre-release-hook: use --tag v{{version}} instead of --latest
  (--latest resolves the previous tag since the new tag doesn't exist
  yet during cargo-release's pre-release-hook)

Author: scarmuega

.github/workflows/ci.yml

@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -16,6 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.91
         with:
           components: rustfmt
@@ -29,6 +38,8 @@ jobs:
       SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.91
         with:
           components: clippy
@@ -45,6 +56,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.91
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --all-targets --all-features
@@ -54,4 +67,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: test/integration.sh

Cargo.toml

@@ -72,5 +72,5 @@ pre-release-hook = [
     "cliff",
     "-o",
     "CHANGELOG.md",
-    "--latest",
+    "--tag", "v{{version}}",
 ]