* Add concurrency settings for a bunch of workflows
* Restrict prod deployments to one at a time but disallow interrupting
* Remove redundant pull_request.types specification
* Add permission matrices to all Actions workflows
Also cleanup a few token references
* Add actions:read permissions for CodeQL
* Add prs:read permissions for unit test workflow