fix: move secrets to env blocks, remove env dump, pin actions [E-1815]

[jonathansantilli]

Summary

• Move cx-api-token from command line argument to env var (was visible in process table)
• Move github-token from curl command line to env var
• Move all ${{ inputs.* }} from run: blocks to env: blocks
• Remove bare env command that dumped all secrets to workflow logs
• Replace bash -l {0} with bash
• Quote all variable expansions
• Pin all action references to immutable commit SHAs

Security Context

Line 71 (./cx configure set --prop-name cx_apikey --prop-value ${{ inputs.cx-api-token }}) places the Checkmarx API key directly on the command line, where it is visible in process listings. Line 74 (env) dumps all environment variables (potentially including secrets) to the workflow log.

The fix passes all secrets through env: blocks and removes the env debug command.

Consumer Impact

None. The action inputs: and outputs: are unchanged. This fix is transparent to all consumers.

Test plan

• No CI configured on this repo — verified by code review
• The same fix pattern (env: blocks instead of direct interpolation, remove eval, quote variables) was tested end-to-end on fix: prevent shell injection via eval in action.yml and review/action.yml [E-1815] action#31 with all checks green and injection test passing

The injection test evidence is documented in detail at: mobb-dev/action#31 (comment)