prevent expression injection (#28)

Prevent expression injection. e.g. suppose you have the following:

```yaml
- env:
    secretApiKey: ${{ secrets.apiKey }} 
  uses: jenseng/dynamic-uses@v1  
  with:
    uses: myactions/validate-pr-title@${{ inputs.actionVersion }}
    with: |
      title: ${{ toJSON(github.event.pull_request.title ) }} 
```

Although we're doing `toJSON` to protect against general YAML
quoting/escaping issues, the string could still contain a GitHub Actions
expression. If `github.event.pull_request.title` contains `Hello ${{
env.secretApiKey }}`, we want to ensure that that expression is not
evaluated in the generated action. Otherwise the `secretApiKey` will be
passed to the dynamically called action, with possible negative
consequences.

It's probably not a huge vulnerability, since composite actions don't
have access to `secrets`, so it's unlikely an attacker could exfiltrate
anything that's not already visible in the logs/etc. But better safe
than sorry 😅

Author: jenseng

.github/workflows/test.yml

@@ -54,7 +54,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-      - name: attempt command substitution via uses
+      - name: Attempt command substitution via uses
         id: command-substitution
         uses: ./.
         with:
@@ -71,3 +71,16 @@ jobs:
             echo "::error::Expected command substitution not to happen"
             exit 1
           fi
+      - name: Attempt expression injection
+        uses: ./.
+        id: expression-injection
+        with:
+          uses: ./.github/actions/echo
+          with: |
+            echo: ${{ '$' }}{{ env.expected }}
+            ignored: whatever
+      - uses: ./.github/actions/assert-equal
+        with:
+          expected: "${{ '$' }}{{ env.expected }}"
+          actual: ${{ fromJSON(steps.expression-injection.outputs.outputs).echo }}
+  

action.yml

@@ -36,7 +36,7 @@ runs:
             id: run
             uses: '$(echo "$uses" | sed "s/'/''/g")'
             with:
-        $(echo "$with" | sed 's/^/      /')
+        $(echo "$with" | sed -E "s/^/      /; s/\\\$\\{\\{/\${{'$'}}{{'\$'}}{{/g")
         DYNAMIC_USES_EOF
     - name: Run
       id: run