Fix remaining zizmor ignore statements

[paddyroddy]

I introduced these some time ago. I've since learnt the proper way to fix these so makes sense the template, at least, has this fix.

[Copilot]

Pull request overview

This PR updates GitHub Actions workflows to eliminate remaining zizmor secrets-outside-env ignores by routing secrets through step-level env and referencing them via the env context in with: inputs.

Changes:

• Move APP_ID / APP_PEM secrets in manage-projects.yaml from with: into step env: and reference them via ${{ env.* }}.
• Move LINKS_PRIVATE_KEY in links.yaml from with: into step env: and reference it via ${{ env.APP_PEM }}.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/manage-projects.yaml	Routes app credentials through step env to remove zizmor ignore comments.
.github/workflows/links.yaml	Routes the private key through step env to remove zizmor ignore comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[paddyroddy]

This seems to have worked differently to how it did on @paddyroddy repos. Abandoning as little advantage.