ci: cut Actions burn — scope push triggers + concurrency-cancel (#51)

Automated by hypatia ci-health-sweep. Scopes `push` to the default
branch (kills push+PR double-runs) and adds `concurrency:
cancel-in-progress` to read-only PR checks. No SPDX/logic changes.

Author: hyperpolymath

.github/workflows/php-security.yml

@@ -11,7 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, master]
+  pull_request:
 permissions:
   contents: read
 jobs:

.github/workflows/rescript-deno-ci.yml

@@ -11,7 +11,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, master]
+  pull_request:
 permissions:
   contents: read
 jobs: