CI: Tweaks to improve security

Mostly storing some uncontrolled inputs into intermediate environment
variables to avoid some template injection issues.

.github/workflows/automerge-dependabot.yml

@@ -2,6 +2,7 @@ name: Auto-merge Dependabot PRs
 
 on:
   pull_request_target:
+    branches: [main]
 
 jobs:
   #
@@ -12,13 +13,15 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     env:
       GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      GH_PR: ${{ github.event.pull_request.number }}
 
     permissions:
       contents: write
       pull-requests: write
 
     steps:
     - name: Set auto-merge
-      run: gh pr merge -R ${{ github.repository }} --merge --auto ${{ github.event.pull_request.number }}
+      run: gh pr merge -R "$GH_REPO" --merge --auto "$GH_PR"
     - name: Review PR
-      run: gh pr review -R ${{ github.repository }} --approve ${{ github.event.pull_request.number }}
+      run: gh pr review -R "$GH_REPO" --approve "$GH_PR"

.github/workflows/backport-prs.yml

@@ -13,6 +13,9 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
+    env:
+      GH_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      GH_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
 
     steps:
       - name: Checkout PR HEAD
@@ -22,7 +25,7 @@ jobs:
           fetch-depth: 100
 
       - name: Fetch PR merge base
-        run: git fetch --no-tags --depth=100 origin ${{ github.event.pull_request.base.sha }}
+        run: git fetch --no-tags --depth=100 origin "$GH_BASE_SHA"
 
       - name: Set up git
         run: |
@@ -38,7 +41,7 @@ jobs:
       - name: Apply PR commits to ${{ steps.get-branch.outputs.backport-branch}} branch
         run: |
           git checkout -b ${{ steps.get-branch.outputs.backport-branch}} origin/${{ steps.get-branch.outputs.backport-branch}}
-          git cherry-pick -x ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}
+          git cherry-pick -x "$GH_BASE_SHA".."$GH_HEAD_SHA"
 
       - name: Create backport PR
         id: create-pr