fix(security): Prevent GitHub script injection in update-tox workflow (#6171)

Co-authored-by: fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>

Author: fix-it-felix-sentry[bot]

.github/workflows/update-tox.yml

@@ -55,11 +55,16 @@ jobs:
 
       - name: Create pull request
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          BRANCH_NAME: ${{ steps.create-branch.outputs.branch_name }}
+          COMMIT_TITLE: ${{ steps.create-branch.outputs.commit_title }}
+          DATE: ${{ steps.create-branch.outputs.date }}
+          BASE_BRANCH: ${{ github.ref_name }}
         with:
           script: |
-            const branchName = '${{ steps.create-branch.outputs.branch_name }}';
-            const commitTitle = '${{ steps.create-branch.outputs.commit_title }}';
-            const date = '${{ steps.create-branch.outputs.date }}';
+            const branchName = process.env.BRANCH_NAME;
+            const commitTitle = process.env.COMMIT_TITLE;
+            const date = process.env.DATE;
             const prBody = `Update our test matrix with new releases of integrated frameworks and libraries.
 
             ## How it works
@@ -100,7 +105,7 @@ jobs:
                 repo: context.repo.repo,
                 title: commitTitle + ' (' + date + ')',
                 head: branchName,
-                base: '${{ github.ref_name }}',
+                base: process.env.BASE_BRANCH,
                 body: prBody,
             });