Avoid running malicious inputs as shell commands in the GitHub Actions

[eason9487]

Changes proposed in this Pull Request:

This PR avoids running malicious inputs as shell commands in the GitHub Actions.

Although these input values are entered by devs who have access to this repo, which means it's almost unlikely to be vulnerable to such attacks, it would be better to fix it.

Detailed test instructions:

📌 E2E Tests workflow

1. View the E2E Tests workflow run that was injected shell commands ls -la
   
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9028825818/job/24809992921
     
     
2. View the E2E Tests workflow run that avoids the shell command injections
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9029050182/job/24810643369
     
3. Check if the "Install WP release candidate" and "Install WC release candidate" steps can work as before when entering valid versions
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9029173521/job/24811003759

📌 PHP Unit Tests

1. View the PHP Unit Tests workflow run that was injected shell commands ls -la and cat README.md
   
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9029457821/job/24811829608
     
     
2. View the PHP Unit Tests workflow run that avoids the shell command injections
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9029552347/job/24812099947
     
3. Check if the "Install WP tests" step can work as before when entering valid versions
   • https://github.com/woocommerce/google-listings-and-ads/actions/runs/9029679289/job/24812468787#step:5:2

Changelog entry

[martynmjones]

Hey @eason9487, thanks for adding extra protections for the input values!

Reviewed the changes and the example runs and all looks good ✅