Add additional GHA settings

[mhucka]

This adds some miscellaneous settings:

• Set workflow default permissions as read-only (per security best practices)
• Support merge queues
• Support manual invocation (for debugging)
• Make it so that starting another run of this workflow will cancel any ongoing runs for the same PR or branch (e.g., because a new push happened while the workflow is still running from a previous push)

[Strilanc]

If you can get merge queues working smoothly, I'd absolutely use them. Last time I tried I failed.