Fix template injection vulnerabilities in workflows

[dschuff]

Address security findings from zizmor by passing GitHub context
variables through the environment instead of expanding them directly
in shell scripts.

[sbc100]

Can you just use single quotes here instead?

Funny I was just telling @tlively about this crazy injection the other day

[dschuff]

I think using single quotes won't do it, because an attacker who controls github.base_ref can inject either single or double quotes into it to terminate the string and follow it with a malicious command. (which gets written into the temporary script). Using env variables means that the value doesn't get written into the script.