Fix potential security issue with variable interpolation in the run step

[coderabbitai]

There is a potential security issue with variable interpolation in the run: step in the GitHub Actions workflow file .github/workflows/publish-central.yml.

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes for the environment variable, like this: "$ENVVAR".

Suggested change:

- run: mvn versions:set -B -DnewVersion=\${{ github.event.inputs.tag }}
+ env:
+   NEW_VERSION: \${{ github.event.inputs.tag }}
+ run: mvn versions:set -B -DnewVersion="$NEW_VERSION"

Relevant PR: #63
Comment URL: here

Requested by overheadhunter.

[infeo]

Fixed in 83a9097

[overheadhunter]

Fixed the fix in 75c56b7