fix(ci): prevent code injection in cleanup-prerelease workflow (#174)

Move github.event.pull_request.head.ref from direct shell interpolation to environment variable to prevent script injection attacks via malicious branch names.

Fixes https://github.com/groupsky/ya-modbus/security/code-scanning/10

Author: groupsky

.github/workflows/cleanup-prerelease.yml

@@ -93,11 +93,13 @@ jobs:
 
       - name: Summary
         if: always()
+        env:
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
           echo "## Pre-release Cleanup Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "- PR: #${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY
-          echo "- Branch: ${{ github.event.pull_request.head.ref }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Branch: $PR_BRANCH" >> $GITHUB_STEP_SUMMARY
           echo "- Status: ${{ github.event.pull_request.merged && 'Merged' || 'Closed without merge' }}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY