Avoid letting outdated CI runs continue if a PR receives
new changes. Outside a PR we let them continue running
by tying the concurrency to the commit hash instead.
Also only let one CodeQL or Hacktoberfest job run at a time.
Other CI platforms we use have this build in, but GitHub
unfortunately neither by default nor with a simple option.
This saves CI resources and therefore a little energy.
Approved-by: Daniel Stenberg
Approved-by: Max Dymond
Closes#9533
