prevent expression injection

[jenseng]

Prevent expression injection. e.g. suppose you have the following:

- env:
    secretApiKey: ${{ secrets.apiKey }} 
  uses: jenseng/dynamic-uses@v1  
  with:
    uses: myactions/validate-pr-title@${{ inputs.actionVersion }}
    with: |
      title: ${{ toJSON(github.event.pull_request.title ) }} 

Although we're doing toJSON to protect against general YAML quoting/escaping issues, the string could still contain a GitHub Actions expression. If github.event.pull_request.title contains Hello ${{ env.secretApiKey }}, we want to ensure that that expression is not evaluated in the generated action. Otherwise the secretApiKey will be passed to the dynamically called action, with possible negative consequences.

It's probably not a huge vulnerability, since composite actions don't have access to secrets, so it's unlikely an attacker could exfiltrate anything that's not already visible in the logs/etc. But better safe than sorry 😅