Harden the release workflows against injected values

[erseco]

Stacked on #138.

Workflow hardening

Two workflows expanded external values straight into shell scripts, inside jobs that hold a write token.

• check-editor-releases.yml
  • Problem: the upstream exelearning/exelearning release tag_name was expanded directly into run: steps. This job holds contents: write and actions: write.
  • Fix: the tag must match ^v[0-9][0-9A-Za-z.-]*$, and later steps read it through env:.
• release.yml
  • Problem: the workflow_dispatch inputs were expanded into the script and written to GITHUB_ENV unchecked. A newline in any of them would define arbitrary variables, such as BASH_ENV, for every later step.
  • Fix: the inputs are read through env: and validated first.
• Both workflows: they build the editor from third-party packages, so actions/checkout now uses persist-credentials: false. check-editor-releases passes the token only to its single git push.
• npm: applied the non-breaking npm audit fix to the dev tree (21 → 17 advisories). The rest need major @wp-playground/wp-env bumps and are left to Dependabot.

Not changed on purpose

• Pinning third-party actions to SHAs: left out. AGENTS.md records a preference for version tags maintained by Renovate.
• composer.lock: it is gitignored, so CI already resolves the patched PHPCS, WPCS and PHPCSUtils releases.

Verification

actionlint reports no errors. The only notices are the same 19 shellcheck info/style notices that were already reported before this change.

[github-actions]

Test in WordPress Playground

Test the plugin with the code from this branch:

ℹ️ The eXeLearning editor is fetched from the shared release and unpacked into the plugin when the playground boots, so the first load may take a few extra seconds. ELP upload, shortcode, Gutenberg block and preview work normally.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.87%. Comparing base (9f8fb53) to head (952aac1).

Additional details and impacted files

@@                          Coverage Diff                          @@
##             hotfix/admin-preview-opaque-origin     #139   +/-   ##
=====================================================================
  Coverage                                 96.87%   96.87%           
  Complexity                                  864      864           
=====================================================================
  Files                                        39       39           
  Lines                                      4324     4324           
=====================================================================
  Hits                                       4189     4189           
  Misses                                      135      135           

Flag	Coverage Δ
javascript	95.71% <ø> (ø)
php	97.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.