Restrict concurrency for CI

[ocaisa]

We are not very careful in our CI about cancelling existing CI runs when a new commit is pushed, we should consider adding:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

to our PR workflows