fix: prevent CI injection via unsanitized GitHub context interpolation (#12224)

Pass github.event.pull_request.head.ref through env: instead of
interpolating it directly into run: shell steps. This prevents bash
from evaluating command substitutions embedded in malicious branch names
before input validation runs.

Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>