- add concurrency groups to cancel the in-progress workflow if a new
one is triggered
- update and pin all action versions to full-length SHAs
- update and pin all dependency versions to specific versions
- ensure git credentials are not persisted when using actions/checkout