Build: Cancel superseded PR runs in lightweight CI workflows

[wombatu-kun]

What

Adds a concurrency: group with PR-scoped cancel-in-progress to the five lightweight, PR-triggered workflows that did not have one: docs-ci, license-check, zizmor, codeql, and asf-allowlist-check.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

Why

The ASF GitHub Actions pool is a shared, capacity-limited resource, and infra guidance asks every project to cancel superseded PR runs so stale commits stop holding runner slots. When several commits are pushed to a PR in quick succession, runs triggered by earlier commits keep going even though their results are no longer relevant. The heavy CI workflows (spark, flink, java, hive, kafka-connect, delta-conversion, and others) already cancel superseded PR runs with exactly this pattern; these five lightweight workflows were the remaining gap. docs-ci is the most valuable to fix because each superseded run holds a scarce macOS runner.

Notes

The block is identical to the one already used across the heavy workflows, including the conditional cancel-in-progress: ${{ github.event_name == 'pull_request' }} so that pushes to main and scheduled runs (zizmor, codeql, asf-allowlist-check) are never interrupted; only superseded pull_request runs are cancelled. For the workflows that also run on main or on a schedule, two overlapping non-PR runs now serialize within the group instead of running in parallel, which is harmless for these short jobs.