Update to prevent injection vuln

Co-authored-by:  Yeger <yeger00@gmail.com>

Author: Vivian Rook

.github/workflows/update-container-tags.yaml

@@ -18,8 +18,10 @@ jobs:
         run: |
           git fetch
       - name: git checkout
+        env:
+          HEADREF: ${{ github.head_ref }}
         run: |
-          git checkout ${{ github.head_ref }}
+          git checkout "$HEADREF"
 
       # compare  to upstream main branch
       - name: git add remote