ci: Replace Github template expansion with env variable expansion.

This prevents an issue that allows Git refs to escape the quotation marks and inject Bash commands into the step.

Author: seifertm

.github/workflows/main.yml

@@ -155,7 +155,7 @@ jobs:
       if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
       run: |
         set -e
-        git for-each-ref "${{ github.ref }}" --format='%(contents)' > release-notes.rst
+        git for-each-ref "${GITHUB_REF}" --format='%(contents)' > release-notes.rst
         # Strip PGP signature from signed tags
         sed -i "/-----BEGIN PGP SIGNATURE-----/,/-----END PGP SIGNATURE-----\n/d" release-notes.rst
     - name: Convert Release Notes to Markdown