3.x: no concurrency group, test report never publishes, and NettyUtilIT never runs

[nikagra]

Four unrelated defects noticed while scoping JaCoCo coverage for 3.x (#1018). None is caused by
that change and all four predate it; they are filed together because each one is a CI lane that
does not do what it looks like it does.

tests@v1.yml declares no concurrency: group

.github/workflows/tests@v1.yml never declares a concurrency: group, so pushing to a branch that
already has a run in flight leaves the superseded run executing a full integration suite — four
lanes of roughly 20 to 35 minutes each. The 4.x workflow has the same gap.

The 3.x test report never publishes

.github/workflows/tests-reports@v1.yml triggers on workflow_run filtered by
workflows: ['Tests']. Both branches keep their test workflow at the same path,
.github/workflows/tests@v1.yml, so GitHub registers a single workflow (id 25299419) and labels
it from the default branch: Tests (Driver 4.x). Neither that name nor this branch's own
Tests (Driver 3.x) matches the Tests filter, so the report job never fires on 3.x at all.

driver-tests/shading's NettyUtilIT never runs

Failsafe picks NettyUtilIT up at verify by its *IT.java name — both copies, shaded and
unshaded — but its single test method is annotated @Test(groups = "unit"), and Failsafe filters
on <groups>${test.groups}</groups>.

The only verify invocation that runs tests is make test-integration-scylla /
test-integration-cassandra, and both pass -Pshort, which sets test.groups=short. Every other
verify in the tree — make check, i.e. the Full verify CI job, and
.download-verify-dependencies — passes -DskipTests. So the group filter excludes the test on
every invocation the build actually makes. Either the annotation or the lane invocation is wrong.

tests@v1.yml hardening: persisted checkout credentials, and no permissions: block

actions/checkout writes the repository token into .git/config unless told not to. Six of the
seven checkout steps in .github/workflows/tests@v1.yml omit persist-credentials: false, even
though the repo already uses it in .github/workflows/docs-pr.yaml and docs-pages.yaml. Nothing
in those jobs needs git authentication — they run Maven, never push, and no git-reading Maven plugin
exists in the tree. (The seventh, the coverage-report job, was fixed in #1018.)

Separately, the workflow declares no permissions: block at any level, so every job runs with the
default broad token. release.yml is the only workflow in the repo that sets one.

One caveat for whoever picks this up: actions/download-artifact in the coverage-report job may
need actions: read, and that job is continue-on-error, so a too-narrow permissions: block would
break the coverage metric silently rather than turning a check red. Verify against the job log,
not the check status.

Refs: #1018