fix(lint-content): move variable to env to prevent command injection

[svennergr]

Description

This PR moves the existing DIFF_DOCUMENTS environment variable to be read from environment variables instead of interpolating that variable in the run script itself.

Motivation

This prevents command/script injections.

[fiji-flo]

Thanks a lot for fixing!

[OnkarRuikar]

A few questions:

1. Should we also use intermediate environment variables?
2. We didn't do this change on line 35. Can we should we do it at least for sake of consistency?
3. Should we do this in other workflows as well? Regardless of the pull_request_target trigger? If not, then for consistency?

[Josh-Cena]

@OnkarRuikar I believe that this PR only fixes env variables created by us, as env.HEAD_SHA etc. are injected by GH and should be treated as secure. I'm +1 for consistency though.