CI/GHA: cancel outdated CI runs on new PR changes

Avoid letting outdated CI runs continue if a PR receives
new changes. Outside a PR we let them continue running
by tying the concurrency to the commit hash instead.

Also only let one CodeQL or Hacktoberfest job run at a time.

Other CI platforms we use have this build in, but GitHub
unfortunately neither by default nor with a simple option.

This saves CI resources and therefore a little energy.

Approved-by: Daniel Stenberg
Approved-by: Max Dymond
Closes #9533

.github/workflows/hacktoberfest-accepted.yml

@@ -5,11 +5,15 @@
 name: Hacktoberfest
 
 on:
-  # run for all pushes to master branch
+  # this must not ever run on any other branch than master
   push:
     branches:
     - master
 
+concurrency:
+  # this should not run in parallel, so just run one at a time
+  group: ${{ github.workflow }}
+
 permissions:
   # requires issues AND pull-requests write permissions to edit labels on PRs!
   issues: write