fix: prevent script injection in test coverage workflow [WPB-27114]

[screendriver]

WPB-27114 Command Injection vulnerability in wireapp/wire-web-packages .github/workflows/test-coverage-report.yml

Pull Request

Summary

Fix unsafe interpolation of the manually supplied tag workflow input into shell scripts in test-coverage-report.yml.

The workflow now passes untrusted and derived values through step-level environment variables before using them in run: steps, rather than interpolating GitHub Actions expressions directly into the generated shell source.

This covers the original Semgrep finding as well as the downstream uses of the parsed tag, package, and version values.

No workflow permissions or behavior are intentionally changed.

---

Security Checklist (required)

• External inputs are validated & sanitized on client and/or server where applicable.
• API responses are validated; unexpected shapes are handled safely (fallbacks or errors).
• No unsafe HTML is rendered; if unavoidable, sanitization is applied and documented where it happens.
• Injection risks (XSS/SQL/command) are prevented via safe APIs and/or escaping.

Accessibility (required)

• I have read and this PR upholds our Accessibility Best Practices.

Standards Acknowledgement (required)

• I have read and this PR upholds our Coding Standards and Tech Radar Choices.

---

Screenshots or demo (if the user interface changed)

Notes for reviewers

• Trade-offs:
• Follow-ups (linked issues):
• Linked PRs (e.g. web-packages):