ci: harden workflows with concurrency, timeouts, and pinned actions

[pataar]

Summary

Hardens both GitHub Actions workflows (tests.yml, static-analysis.yml) for supply-chain safety and CI efficiency.

• Concurrency — superseded PR runs are now cancelled (cancel-in-progress gated to pull_request events, so post-merge runs on main/6.x still complete). Key uses head_ref || ref so a PR's push + pull_request events share one group.
• Timeouts — timeout-minutes: 15 on every job to backstop hung runs.
• Caching refactor — the repeated 3-step composer-cache dance replaced with ramsey/composer-install. Tests keep the composer require ... --no-update step and use dependency-versions: highest for the Laravel matrix; custom-cache-suffix isolates caches per matrix entry.
• SHA-pinned actions — all four actions pinned to immutable commit SHAs with # version comments. Dependabot maintains these going forward (no config change needed).
• PHPStan on PHP 8.3 — analysis now runs on the lowest supported version (was 8.4) to catch floor-version issues.

Pinned actions

Action	Version	SHA
actions/checkout	v6.0.3	9f698171
shivammathur/setup-php	2.37.2	f3e473d1
ramsey/composer-install	3.2.1	a8d0d959
coverallsapp/github-action	v2.3.7	5cbfd81b

Test plan

• YAML validated for both workflows.
• CI on this PR exercises the refactored caching + concurrency end-to-end.

Note

6.x still appears in the push triggers — flagging in case that branch is stale and the reference should be dropped.

[coveralls]

coverage: 100.0%. remained the same — ci/harden-workflows into main