ci(update): prevent possible code injection

[fgreinacher]

PR Checklist

Please check if your PR fulfills the following requirements:

• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

[ ] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Build related changes
[x] CI related changes
[ ] Documentation content changes
[ ] Other... Please describe:

What is the current behavior?

The release job directly uses a input variable, making it possible to inject code in the job.
The risk here is quite low, because it is only ran when the pipeline is triggered. But nevertheless it's good to follow best practices here. See https://github.com/boostsecurityio/poutine/blob/main/docs/content/en/rules/injection.md.

Issue Number: N/A

What is the new behavior?

As suggested in the linked documentation it stores the input in an environment variable and uses that within the script.

Does this PR introduce a breaking change?

[ ] Yes
[x] No

Other information

⚒️ with ❤️ by Siemens