ci: reduce API burden and stop using a PAT in trusted workflows

Author: consideRatio

.github/workflows/tests.yaml

@@ -8,6 +8,15 @@ on:
       - "v*"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-24.04
@@ -35,10 +44,9 @@ jobs:
   tests:
     runs-on: ubuntu-24.04
     env:
-      # Use TOKEN_READONLY if available (pushed branches), otherwise use GITHUB_TOKEN (PRs)
-      # TOKEN_READONLY is a PAT for @choldgraf that only has read-access to this repo but isn't available in PRs.
-      GITHUB_ACCESS_TOKEN: "${{ secrets.TOKEN_READONLY || github.token }}"
+      GITHUB_ACCESS_TOKEN: "${{ github.token }}"
     strategy:
+      max-parallel: 1
       matrix:
         include:
           # Only test oldest supported and latest python version to reduce