Avoid running malicious inputs as shell commands in the GitHub Actions

[eason9487]

Changes proposed in this Pull Request:

This PR avoids running malicious inputs as shell commands in the GitHub Actions.

Although these input values are entered by devs who have access to this repo, which means it's almost unlikely to be vulnerable to such attacks, it would be better to fix it.

Checks:

• Does your code follow the WordPress coding standards?
• Have you written new tests for your changes, as applicable?
• Have you successfully run tests with your changes locally?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Detailed test instructions:

1. Please refer to the PR Avoid running malicious inputs as shell commands in the GitHub Actions google-listings-and-ads#2397 that fixes the same issue.
2. Check if the "Install WP release candidate" and "Install WC release candidate" steps can work as before when entering valid versions
   • https://github.com/woocommerce/woocommerce-google-analytics-integration/actions/runs/9029889610/job/24813107364
3. Check if the "Install WP tests" step can work as before when entering valid versions
   • https://github.com/woocommerce/woocommerce-google-analytics-integration/actions/runs/9029901200/job/24813139876#step:5:2

Changelog entry

[martynmjones]

Hey @eason9487, thanks for adding extra protections for the input values!

Reviewed the changes and all looks good ✅