GHA: set concurrency: where missing

To silence zizmor 1.16.0 warnings.

Also:
- http3-linux: replace hard-coded workflow name with variable.
  Follow-up to a8174176b5 #13841
- codeql: set `cancel-in-progress: true`.
  zizmor apparently does not allow `false` in pedantic mode anymore:
  https://github.com/zizmorcore/zizmor/pull/1227
- codeql: sync concurrency setting with the rest of the jobs.
  (I'm not sure this is correct, or why it was previously special-cased.)

Expressions used (before and after this patch):
- `group: ${{ github.workflow }}-${{ github.event.sha }}-${{ github.event.target_url }}`
  for GHA/appveyor-status.
- `group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}`
  for all the rest.

Ref: https://github.com/curl/curl/actions/runs/18776245057/job/53571438139?pr=19209

Closes #19215

.github/workflows/codeql.yml

@@ -32,7 +32,8 @@ name: 'CodeQL'
     - cron: '0 0 * * 4'
 
 concurrency:
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
 
 permissions: {}