Add build-workflow concurrency and npm cache for JS setup (CI-009/CI-007)

[ydesgagn]

Summary

Two CI-efficiency findings from the ci-actions code review, both in the generated build.yml (so they belong in the generator).

Key changes:

• CI-009 lib/ghb/application.rb (workflow_set_defaults): when the old workflow has no concurrency, default the generated build workflow to { group: build-${{github.ref}}, cancel-in-progress: true } (mirrors the existing permissions "use old, else default" pattern). Without it, every push to an open PR starts a fresh ~20-job build while the superseded run keeps going.
• CI-007 config/languages.yaml: set the JavaScript node-cache setup option value: npm (was empty). Empty setup_options values are skipped by add_setup_options; a non-empty value makes it auto-copied into the setup step's with: as ${{env.NODE-CACHE}} (consumer-overridable via repo env), exactly like node-version. The setup action has no separate npm cache step — setup-node only caches when node-cache is set — so npm deps were re-fetched every run. This is a pure config change; no generator code change needed.
• spec/fixtures/workflow_generation/build.yml: golden fixture regenerated — diff is exactly the added concurrency: block (the golden scenario is a Ruby project, so the JS node-cache config does not affect it).

After merge, ci-actions' build.yml is regenerated (companion PR) to pick both up — same pattern as CI-002 (#387 → #202).

Types of changes

• Bugfix (fixes an issue)
• New feature (adds functionality)
• Refactoring (improves code without changing functionality)
• Breaking change (incompatible changes)
• Build or security update (updates dependencies, libraries, or security patches)
• Code style or documentation update (formatting, renaming, or documentation changes)
• Other (please describe):

Checklist

• Unit tests added to validate my fix/feature
• I have manually tested my change
• I did not add automation test. Why ?: CI-009 is covered by the golden-file integration test (regenerated, diff = the concurrency block); CI-007 is a one-line config value consumed by the already-tested add_setup_options path
• Database changes requiring migration with downtime or reprocessing of existing data
• The SOUP file lists the risk Level, requirements and verification reasoning associated with each library
• `readme.md` includes sections on introduction, installation, usage, and contributing
• `docs/architecture.md` includes sections on the architecture diagram, software units, software of unknown provenance, critical algorithms and risk controls related to PII and security
• Impact on PII, privacy regulations (CCPA/GDPR/PIPEDA), CIS benchmarks or security (availability/confidentiality/integrity); management must be notified