ci: use environment variables in GitHub Actions for improved security

[knqyf263]

Description

This PR improves the security of the backport GitHub Actions workflow by using environment variables instead of direct context interpolation in shell commands.

Testing

Successfully tested in aquasecurity/trivy-test repository:

• Test PR: Test backport functionality [backport: release/v0.61] trivy-test#48
• Successful workflow run: https://github.com/aquasecurity/trivy-test/actions/runs/17456709049
• The backport workflow correctly created a backport PR using the updated secure implementation

Changes

• Replace direct GitHub context interpolation (${{ github.repository }}, ${{ github.actor }}) with built-in environment variables ($GITHUB_REPOSITORY, $GITHUB_ACTOR)
• Pass issue number via environment variable instead of direct interpolation
• Add proper shell quoting for script arguments

Security Improvements

This change follows GitHub Actions security best practices by:

1. Using environment variables to prevent expression injection attacks
2. Properly quoting shell arguments
3. Eliminating direct interpolation of user-controlled data in shell commands

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[Copilot]

Pull Request Overview

This PR enhances the security of the GitHub Actions backport workflow by replacing direct context interpolation with environment variables to prevent expression injection attacks.

• Replace direct GitHub context interpolation with built-in environment variables for repository and actor
• Use environment variables for issue number instead of direct interpolation
• Add proper shell quoting for script arguments

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}