Unexpectedly transformed `\n` inside GitHub secret in `containerMode: kubernetes`

Checks

• I've already read https://github.com/actions-runner-controller/actions-runner-controller/blob/master/TROUBLESHOOTING.md and I'm sure my issue is not covered in the troubleshooting guide.
• I'm not using a custom entrypoint in my runner image

Controller Version

0.26.0

Helm Chart Version

No response

CertManager Version

No response

Deployment Method

Kustomize

cert-manager installation

Standard installation

Checks

• This isn't a question or user support case (For Q&A and community support, go to Discussions. It might also be a good idea to contract with any of contributors and maintainers if your business is so critical and therefore you need priority support
• I've read releasenotes before submitting this issue and I'm sure it's not due to any recently-introduced backward-incompatible changes
• My actions-runner-controller version (v0.x.y) does support the feature
• I've already upgraded ARC (including the CRDs, see charts/actions-runner-controller/docs/UPGRADING.md for details) to the latest and it didn't fix the issue
• I've migrated to the workflow job webhook event (if you using webhook driven scaling)

Resource Definitions

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: my-runner
spec:
  replicas: 2
  template:
    spec:
      containerMode: kubernetes
      labels:
        - my-runner
      repository: owner/repo
      serviceAccountName: my-runner
      workVolumeClaimTemplate:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: 10Gi
        storageClassName: standard

To Reproduce

1) Use a GitHub workflow that passes a secret JSON to a job step

jobs:
  diff:
    runs-on: ubuntu-latest
    steps:
      - id: "auth"
        uses: "google-github-actions/auth@v0"
        with:
          credentials_json: "${{ secrets.GCP_SA_KEY }}"

2) Step fails to parse the JSON

Describe the bug

The JSON failed to parse.

Run google-github-actions/auth@v0
  with:
    credentials_json: ***
  
    create_credentials_file: true
    export_environment_variables: true
    cleanup_credentials: true
    access_token_lifetime: 3600s
    access_token_scopes: https://www.googleapis.com/auth/cloud-platform
    retries: 0
    id_token_include_email: false
  env:
    BAZEL_OUTPUT_BASE: bazel-output-base
Run '/runner/k8s/index.js'
  shell: /runner/externals/node16/bin/node ***0***
Error: google-github-actions/auth failed with: retry function failed after 1 attempt: failed to parse service account key JSON credentials: unexpected token = in JSON at position 1854
Error: Error: failed to run script step: command terminated with non-zero exit code: error executing command [sh -e /__w/_temp/cf6dcb40-67c9-11ed-ace2-854c4d1b0657.sh], exit code 1
Error: Process completed with exit code 1.
Error: Executing the custom container implementation failed. Please contact your self hosted runner administrator.

I added some extra steps to debug this and confirm the JSON was being transformed.

      - name: Debug the secret
        env:
          SERVICE_ACCOUNT_KEY: "${{ secrets.GCP_SA_KEY }}"
        run: |
          echo "${SERVICE_ACCOUNT_KEY}" > ${RUNNER_TEMP}/credentials.json
      - uses: actions/upload-artifact@v3
        with:
          name: credentials.json
          path: ${{ runner.temp }}/credentials.json

The key originally looks like {"type":"service_account","project_id":"my-gcp-project","private_key_id":"some-id","private_key":"-----BEGIN PRIVATE KEY-----\nfirstbase64data\n...morebase64data...\nlastbase64data\n-----END PRIVATE KEY-----\n","client_email":"my-service-account@my-gcp-project.iam.gserviceaccount.com","client_id":"some-client-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url":"https://www.googleapis.com/robot/v1/metadata/x509/my-service-account%40my-gcp-project.iam.gserviceaccount.com"}

In the uploaded artifact, I can see that the JSON is transformed, with the \n getting interpreted.

`{"type":"service_account","project_id":"my-gcp-project","private_key_id":"some-id","private_key":"-----BEGIN PRIVATE KEY-----
firstbase64data
...morebase64data...
lastbase64data
-----END PRIVATE KEY-----
","client_email":"my-service-account@my-gcp-project.iam.gserviceaccount.com","client_id":"some-client-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url":"https://www.googleapis.com/robot/v1/metadata/x509/my-service-account%40my-gcp-project.iam.gserviceaccount.com"}`

It's not obvious to me where this transformation is happening. It might be in ARC, or could be in runner-container-hooks. I'm not quite sure.

Describe the expected behavior

The secret value should not be transformed when passing it to the k8s Pod, since that breaks parsing.

Whole Controller Logs

N/A

Whole Runner Pod Logs

N/A

Additional Context

No response

Start by reproducing the issue with the supplied RunnerDeployment, containerMode: kubernetes configuration, and workflow that passes GCP_SA_KEY to google-github-actions/auth. Trace the secret from actions-runner-controller through runner-container-hooks and into the Kubernetes pod; done means the JSON reaches the step unchanged and parses successfully.