GH Actions: always use env for handling user input

[jrfnl]

GitHub Actions allows workflows to define template expansions, which occur within special ${{ ... }} delimiters. These expansions happen before workflow and job execution, meaning the expansion of a given expression appears verbatim in whatever context it was performed in.

Template expansions aren't syntax-aware, meaning that they can result in unintended shell injection vectors. This is especially true when they're used with attacker-controllable expression contexts, such as github.event.issue.title (which the attacker can fully control by supplying a new issue title).

Ref:

• https://securitylab.github.com/resources/github-actions-untrusted-input/
• https://docs.zizmor.sh/audits/#template-injection

[jrfnl]

I've reverted this PR as it's not working as intended - it ended up creating a ${DIRTY_LABEL} label in the repo, which was not the intention.