ci: pin actions to commit SHAs, cancel superseded runs

Action references by tag (checkout@v4, setup-go@v5,
govulncheck-action@v1) execute whatever a retargeted tag points at,
so a compromised tag would run with contents:read on this repo. Pin
each to the commit SHA its tag resolves to today, and cancel
superseded runs on the same ref.

.github/workflows/ci.yml

@@ -8,13 +8,18 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # Pinned by commit SHA: tags are mutable.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version-file: go.mod
           cache: true
@@ -29,7 +34,7 @@ jobs:
         run: go test -race -count=1 ./...
 
       - name: Govulncheck
-        uses: golang/govulncheck-action@v1
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1
         with:
           go-version-input: ""
           go-package-input: ./...