Avoid running untrusted input as shell commands in the GitHub Actions

[eason9487]

Changes proposed in this Pull Request:

This PR avoids running untrusted inputs as shell command in the GitHub Actions.

Ref: https://securitylab.github.com/research/github-actions-untrusted-input/

Detailed test instructions:

1. View the workflow that simulates the same uses of ${{ github.head_ref }} in this repo
   • https://github.com/eason9487/gha-playground/blob/test/vulnerability/.github/workflows/untrusted-input.yml
2. View a test PR trying to inject command ls -la via branch name zzz";ls${IFS}-la;#
   • Test vulnerability eason9487/gha-playground#4
3. View the workflow run that was injected shell command ls -la from a forked repo
   • https://github.com/eason9487/gha-playground/actions/runs/9011882305/job/24760188266
     
4. View the fix commit
   • eason9487/gha-playground@957a051
5. View the workflow run that avoids the shell command injections
   • https://github.com/eason9487/gha-playground/actions/runs/9012011241/job/24760504989
     
6. Check if the "Build" workflow run in this repo is successful
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9012343327/job/24761392142?pr=2394

Changelog entry

[martynmjones]

Hey @eason9487, thanks for keeping our repo's safe!

Changes look good and I'm not seeing any other variables at risk of injection ✅