fix(security): prevent command injection in GitHub Actions workflows [ENG-1131]

[kevinmessiaen]

Description

• Use environment variables instead of direct interpolation for user inputs
• Add proper quoting for environment variables in shell commands
• Fix create-release.yml: use INPUT_VERSION env var for inputs.version
• Fix retry-workflow.yml: use RUN_ID env var for inputs.run_id

Resolves high-severity security vulnerability in workflow variable interpolation

Related Issue

Type of Change

• 📚 Examples / docs / tutorials / dependencies update
• 🔧 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🔐 Security fix

Checklist

• I've read the CODE_OF_CONDUCT.md document.
• I've read the CONTRIBUTING.md guide.
• I've written tests for all new methods and classes that I created.
• I've written the docstring in Google format for all the methods and classes that I used.
• I've updated the pdm.lock running pdm update-lock (only applicable when pyproject.toml has been
  modified)

[linear]

ENG-1081 Use good practices for CI workflow var interpolation

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[linear]

ENG-1131 Mitigate script injection in `giskard-oss` CI