Fix script injection in release.yml via env-var indirection

[felicityzhao9]

Summary

Fixes a script-injection vulnerability (CWE-94) in .github/workflows/release.yml.
Untrusted workflow_dispatch inputs (version_number, commit_id) and github.actor
were interpolated directly into shell run: blocks, allowing arbitrary command
execution if a crafted value were supplied when dispatching the release workflow.

What changed

Applied environment-variable indirection — the same pattern already used safely
by the clean-existing-tag-and-release job — to the two affected jobs:

• add-sbom-and-tag-commit: added a job-level env: block
  (VERSION_NUMBER, COMMIT_ID, ACTOR) and replaced every
  ${{ github.event.inputs.* }} / ${{ github.actor }} reference inside run:
  blocks with quoted shell variables ("$VERSION_NUMBER", "$COMMIT_ID", "$ACTOR").
• create-zip: added a job-level env: block and replaced the
  ${{ github.event.inputs.version_number }} references in the zip/unzip/diff
run: steps with "$VERSION_NUMBER".

GitHub context expressions used in with:, if:, name:, body:, and ref:
contexts are left unchanged — those are action inputs / expression-engine contexts,
not shell, and are not injection vectors.

Why this is safe

With env-var indirection, untrusted values are passed to the shell as environment
variables rather than being substituted into the script text before execution, so
they can no longer break out of the intended command. This is the approach
recommended by GitHub's security hardening guidance for Actions.

Behavior

No functional change. This is a strict refactor from expression interpolation to
env-var indirection; the commands run exactly as before. Quoting the variables also
improves robustness for values containing spaces.

Verification

• Confirmed no ${{ github.event.inputs.* }} or ${{ github.actor }} expressions
  remain inside any run: block.
• Diff is limited to .github/workflows/release.yml (1 file changed).