CI: add permissions, a concurrency group, and SHA-pin actions

[emirhan-karaca]

Closes #33.

Summary of Changes

This PR applies three GitHub Actions CI hardening and efficiency enhancements to .github/workflows/ci.yml:

1. Top-Level permissions Declaration:

   • Explicitly adds permissions: contents: read at the top level to adhere to the principle of least privilege, replacing repository-wide default token write permissions.
   • The Codecov upload step authenticates via secrets.CODECOV_TOKEN, so only repository read access is required.

2. Top-Level Concurrency Group with Run-ID Fallback:

   • Adds concurrency configuration:

     concurrency:
       group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
       cancel-in-progress: ${{ github.event_name == 'pull_request' }}

   • Cancels redundant, superseded CI runs on pull requests to avoid tying up GitHub Actions runners.
   • Distinctly keys non-PR runs (such as pushes to main) to github.run_id so that queued runs on main are never dropped or superseded.

3. Full 40-Character SHA Pinning Across All 7 Action References:

   • Pins all action references across all three workflow jobs (checks, demo, and test) to immutable 40-character commit SHAs with trailing version comments:
     • actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 (3 occurrences: checks, demo, test)
     • actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 (3 occurrences: checks, demo, test)
     • codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5 (1 occurrence: checks)
   • Fully covers the demo job (actions/checkout and actions/setup-node) merged in PR ci: typecheck and build the demo #51.
   • Preserves all existing YAML comments and indentation.
   • .github/dependabot.yml already monitors the github-actions ecosystem, ensuring Dependabot maintains SHA updates automatically.

Verification Results

• action-pin -check -dir .github/workflows: Exited 0 (0 unpinned actions).
• npm ci: Clean install, entry build succeeded.
• npm test: All 48 Vitest unit tests passed (100% pass).
• npm run typecheck: 0 TypeScript compiler errors.
• npm run lint: 0 ESLint / Prettier code style errors.

[vercel]

@emirhan-karaca is attempting to deploy a commit to the Unlayer Team on Vercel.

A member of the Team first needs to authorize it.