Possible run-shell-injection

Hi Team, one comment, possible run-shell-injection severity high at `.github/workflows/build.yml` line 187. Using variable interpolation with GitHub context data in a run: step could allow an attacker to inject their own code into the runner. GitHub context data can have user input and should be treated as untrusted. Alternatively, you can use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Also, be sure to use double-quotes with the environment variable, like: `"$ENVVAR"`.

_Originally posted by @dv4harr10 in https://github.com/cisagov/client-cert-update/issues/53#issuecomment-1819409062_

Open .github/workflows/build.yml and inspect the run: step at line 187, focusing on GitHub context data used in the shell command. Replace direct interpolation with the issue’s suggested env: approach and ensure the environment variable is quoted. Done means untrusted context is no longer interpolated directly while the workflow remains valid.

Written by the indexing model from the issue text.