Cancel superseded runs of Check PR Labels and Semgrep Differential Scan (#11906)

* Cancel superseded runs of Check PR Labels and Semgrep Differential Scan

Both workflows trigger on pull_request without a concurrency group, so
every push, label or edit on a PR queues a fresh run while the earlier
ones keep their place in the org's shared runner queue. Check PR Labels
listens to six event types, so opening, labelling and editing one PR
queued three identical runs within a minute today.

Give each the same head_ref-keyed group with cancel-in-progress that
CI, Tests and the trunk check already use. Develop pushes are
unaffected: they fall through to run_id, as before.

* Key the new concurrency groups by PR number, not head_ref

Fork PRs often come from a branch named develop, so two of them share
github.head_ref and one would cancel the other's run. The PR number is
unique per PR.

.github/workflows/pr_enforce_labels.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     types: [opened, edited, labeled, unlabeled, synchronize, reopened]
 
+concurrency:
+  group: pr-labels-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   pull-requests: read
   contents: read

.github/workflows/sec_sast_semgrep_pull.yml

@@ -2,6 +2,10 @@
 name: Semgrep Differential Scan
 on: pull_request
 
+concurrency:
+  group: semgrep-diff-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions: read-all
 
 jobs: