Harden label_new_issues-remove_label against template injection

[Copilot]

Description

The cleanup workflow for new issues interpolated ${{ ... }} directly inside run:, which is an unsafe pattern. This change moves workflow expressions into step-level env: and uses shell variables in the script body.

• Scope
  • Updated .github/workflows/label_new_issues-remove_label.yml only.
• Hardening change
  • Added:
    • REMOVE_LABEL_ON_ALL_ISSUES: ${{ github.event.inputs.remove_for_all_issues }}
    • DATE_INPUT: ${{ github.event.inputs.date }}
  • Removed inline assignments using ${{ ... }} from run:.
• Resulting pattern
  • Script now reads only environment variables, avoiding expression interpolation in shell code.

- env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    REMOVE_LABEL_ON_ALL_ISSUES: ${{ github.event.inputs.remove_for_all_issues }}
    DATE_INPUT: ${{ github.event.inputs.date }}
  run: |
    echo "remove_for_all_issues: $REMOVE_LABEL_ON_ALL_ISSUES" >> "$GITHUB_STEP_SUMMARY"
    echo "date: $DATE_INPUT" >> "$GITHUB_STEP_SUMMARY"

Motivation and Context

This addresses template-injection risk in the workflow by applying the recommended safe GitHub Actions pattern: evaluate expressions in env, not inline in shell scripts.