ADFA-4184: Fix run-shell-injection risk in debug.yml Extract Jira step

The "Extract Jira Ticket and Fetch Title" step interpolated github context
(github.repository, github.sha, github.ref) and secrets directly into its
run: script. Those values are attacker-controllable, so a crafted branch or
commit could inject shell code on the runner.

Move every ${{ ... }} interpolation into the step's env: block and reference
them as double-quoted shell variables, per the Semgrep run-shell-injection
guidance. Semgrep p/github-actions now reports 0 findings (was 1).

Author: hal-eisen-adfa

.github/workflows/debug.yml

@@ -251,6 +251,11 @@ jobs:
         env:
           COMMIT_MSG: ${{ steps.pr_info.outputs.COMMIT_MSG }}
           BRANCH_TYPE: ${{ needs.validate_branch.outputs.branch_type }}
+          JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
+          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          REF: ${{ github.ref }}
         run: |
           if [[ "$BRANCH_TYPE" == "community" ]]; then
             echo "Community branch, skipping Jira ticket extraction"
@@ -268,9 +273,9 @@ jobs:
             JIRA_URL="https://appdevforall.atlassian.net/browse/${JIRA_TICKET}"
           
             # Fetch Jira ticket title if credentials are available
-            if [ -n "${{ secrets.JIRA_EMAIL }}" ] && [ -n "${{ secrets.JIRA_API_TOKEN }}" ]; then
+            if [ -n "$JIRA_EMAIL" ] && [ -n "$JIRA_API_TOKEN" ]; then
               JIRA_TITLE=$(curl -s \
-                -u "${{ secrets.JIRA_EMAIL }}:${{ secrets.JIRA_API_TOKEN }}" \
+                -u "$JIRA_EMAIL:$JIRA_API_TOKEN" \
                 -H "Accept: application/json" \
                 "https://appdevforall.atlassian.net/rest/api/3/issue/${JIRA_TICKET}?fields=summary" \
                 | jq -r '.fields.summary // ""' 2>/dev/null || echo "")
@@ -285,7 +290,7 @@ jobs:
           else
             JIRA_TICKET="N/A"
             JIRA_TITLE="$COMMIT_MSG"
-            JIRA_URL="https://github.com/${{ github.repository }}/commit/${{ github.sha }} (Ref: ${{ github.ref }})"
+            JIRA_URL="https://github.com/${REPO}/commit/${SHA} (Ref: ${REF})"
           fi
 
           echo "JIRA_TICKET=$JIRA_TICKET" >> $GITHUB_OUTPUT