Fix gha smells:

- Avoid installing packages without version
- Define permissions for workflows with external actions
- Avoid running CI related actions when no source code has changed
- Stop running workflows when there is a newer commit in PR

.github/workflows/ci.yaml

@@ -3,11 +3,19 @@ name: Tox pytest all python versions
 on:
   push:
     branches: [ main ]
+    paths:
+      - gpt_engineer/**
+      - tests/**
   pull_request:
     branches: [ main ]
 
+concurrency:
+  group: ${{github.workflow}} - ${{github.ref}}
+  cancel-in-progress: true
+
 jobs:
   test:
+    permissions: {}
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -23,7 +31,7 @@ jobs:
         cache: 'pip' #Note that pip is for the tox level. Poetry is still used for installing the specific environments (tox.ini)
 
     - name: Install tox
-      run: pip install tox
+      run: pip install tox==4.15.0
 
     - name: Run tox
       env: