Cancel superseded CI runs on new pushes

A new push to a PR (or ref) now cancels the in-progress validation for
the previous commit instead of letting obsolete pipelines run to
completion. Drafts deliberately keep the full gate set — multi-platform
feedback matters most during iteration.

Signed-off-by: Martin Vogel <martin.vogel@datadice.io>

.github/workflows/codeql.yml

@@ -10,6 +10,10 @@ permissions:
   security-events: write
   contents: read
 
+concurrency:
+  group: codeql-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     runs-on: ubuntu-latest