Tighten CI workflow defaults

Three defensive additions to .github/workflows/ci.yml:

- `permissions: contents: read` at the workflow level. Nothing in the
  workflow needs write access to the repo, and least-privilege defaults
  shrink the blast radius if any action ever turns out to be hostile.

- A `concurrency` group keyed on the workflow and ref, cancelling
  in-progress runs only when triggered by a pull request. Stacked PR
  pushes no longer waste CI minutes on superseded matrices; pushes to
  master and the Saturday cron still run to completion.

- `timeout-minutes: 20` on the test job. The suite finishes in well
  under that locally; the timeout guards against a hung runner (most
  likely on the ruby-head row) eating the GH Actions budget for six
  hours.

Author: nertzy

.github/workflows/ci.yml

@@ -12,10 +12,18 @@ on:
     - cron: "0 18 * * 6" # Saturdays at 12pm CST
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: Ruby ${{ matrix.ruby-version }} / Active Record ${{ matrix.active-record.label }}
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     services:
       postgres:
         image: postgres:latest