Avoid direct template expansion in run blocks

[mara004]

This addresses some findings from zizmor .github/ --persona auditor
See also https://docs.zizmor.sh/audits/#template-injection

[...] zizmor considers all template expansions in code contexts to be code smells, [even ones that are likely safe,] and attempting to selectively permit them is more error-prone than forbidding them in a blanket fashion.

Disclaimer: Untested

[mara004]

@bblanchon WDYT?

Also, do you have some advice if/how I should test this PR? (I wasn't sure it would be worth making a full batch of builds just for testing...)

[bblanchon]

I started a zizmor branch where i will try to fix all the warnings, but i had to put in on pause for the moment.

[mara004]

I see, apologies for not having noticed the branch, and thank you for doing this work. Take your time. :)
Anyway, feel free to close this PR then.