Potential fix for code scanning alert no. 2: Code injection

[ajay-dhangar]

Potential fix for https://github.com/codeharborhub/tutorial/security/code-scanning/2

To fix the problem, we should stop interpolating the untrusted github.event.issue.body directly into the shell script and instead pass it via an environment variable, then read it using native shell syntax ($ISSUE_BODY). This avoids GitHub Actions expression injection in the shell context while preserving existing behavior.

Concretely, in the Check for Security and Trust step (lines 43–49), we will:

• Add an env: section that sets ISSUE_BODY: ${{ github.event.issue.body }}.
• Change the script to use issue_body="$ISSUE_BODY" (or just use $ISSUE_BODY directly) instead of issue_body="${{ github.event.issue.body }}".

We will leave the logic of the checks unchanged. No additional imports or external tools are needed, and no other steps in the file are modified.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Great job, @ajay-dhangar! 🎉 Thank you for submitting your pull request to CodeHarborHub. We appreciate your contribution and enthusiasm! Our team will review it soon. If you have any questions or need further assistance, feel free to reach out. Thanks for contributing!