fix: zizmor "code injection via template expansion" (#2784)

* Refactor action.yml to avoid template expansion, composing command line in Python

* Remove more template expansion

* Make a string quoting that's compatible with pwsh

* Apply suggestions from code review

Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>

---------

Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>
Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>

.github/workflows/test.yml

@@ -157,7 +157,7 @@ jobs:
     - name: Set CIBW_ENABLE
       shell: bash
       run: |
-        if [[ "${GITHUB_REF_NAME}" == "main" ]]; then
+        if [[ "$GITHUB_REF_NAME" == "main" ]]; then
           CIBW_ENABLE=all
         else
           # get the default CIBW_ENABLE value from the test module
@@ -288,9 +288,9 @@ jobs:
       uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
     - name: Run the emulation tests
-      run: uv run --no-sync pytest --run-emulation ${MATRIX_ARCH} test/test_emulation.py
       env:
         MATRIX_ARCH: ${{ matrix.arch }}
+      run: uv run --no-sync pytest --run-emulation "$MATRIX_ARCH" test/test_emulation.py
 
   test-pyodide:
     name: Test pyodide