ci: cancel in-progress CodeQL runs on new PR commits

[Copilot]

codeql-analysis.yml lacked the concurrency cancellation that maven.yml already has, causing stale CodeQL runs to continue wasting resources when a new commit is pushed to an open PR.

Changes

• codeql-analysis.yml: added concurrency block identical to the one in maven.yml
  • PR builds are grouped by PR number → new push cancels the in-progress run
  • Push-to-master builds use run_id as the group key → never cancelled

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}