fix(ci): pass release tag and repo to shell through env

Semgrep's run-shell-injection rule flags ${{ github.ref_name }} and
${{ github.repository }} interpolated into run: blocks. The tag name is
attacker-influenced input (git allows $, ( and ; in ref names), so the
release upload steps now read both through step env and quote them.

.github/workflows/release.yml

@@ -372,10 +372,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.AppImage \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # The .deb and .rpm are thin: they depend on the distro's Python, GTK,
@@ -424,10 +426,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.deb dist/*.rpm \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   build-native-arm64:
@@ -470,10 +474,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.deb dist/*.rpm \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # Pins match .github/workflows/flatpak.yml. These jobs start with the tag
@@ -783,12 +789,14 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           ls -la dist/*.flatpak
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.flatpak \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # Runs last because the aarch64 AppImage, both Flatpak bundles, the native
@@ -848,10 +856,12 @@ jobs:
       - name: Attach SHA256SUMS to the release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/SHA256SUMS \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   publish-pypi:
@@ -1078,11 +1088,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           ls -la dist/*.snap
           gh release upload "$TAG" dist/*.snap \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   publish-snap: