security(gha): fix potential for shell injection

[mdtro]

Running these workflows is gated pretty well, but this mitigates the potential for a script injection attack by passing the input to an intermediary environment variable first.

See https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#example-of-a-script-injection-attack for more details.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.52%. Comparing base (189e4a9) to head (c2c2f66).
Report is 1 commits behind head on master.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4099      +/-   ##
==========================================
- Coverage   79.55%   79.52%   -0.03%     
==========================================
  Files         140      140              
  Lines       15521    15521              
  Branches     2631     2631              
==========================================
- Hits        12347    12343       -4     
- Misses       2338     2340       +2     
- Partials      836      838       +2     

see 3 files with indirect coverage changes

[antonpirker]

Very nice! Thank's @mdtro for discovering and fixing this!