Fix JSON injection vulnerability by using JsonSerializer

Co-authored-by: Malcolmnixon <1863707+Malcolmnixon@users.noreply.github.com>

Author: Copilot

src/DemaConsulting.BuildMark/RepoConnectors/GitHubRepoConnector.cs

@@ -591,8 +591,11 @@ private static async Task<IReadOnlyList<Release>> GetAllReleasesAsync(
         // This creates minimal Release objects with only TagName populated
         return releaseTagNames.Select(tagName =>
         {
-            var json = $$"""{"tag_name":"{{tagName}}"}""";
-            return Newtonsoft.Json.JsonConvert.DeserializeObject<Release>(json) ?? throw new InvalidOperationException($"Failed to create Release object for tag {tagName}");
+            // Use JsonConvert with a proper object to avoid JSON injection
+            var releaseData = new { tag_name = tagName };
+            var json = Newtonsoft.Json.JsonConvert.SerializeObject(releaseData);
+            var release = Newtonsoft.Json.JsonConvert.DeserializeObject<Release>(json);
+            return release ?? throw new InvalidOperationException($"Failed to create Release object for tag {tagName}");
         }).ToList();
     }