Fix code injection vulnerability in release workflow

[Copilot]

Addresses remaining code injection vulnerability in .github/workflows/release-with-sbom.yml where a GitHub expression was embedded directly in a shell script.

Changes

• Moved ${{ steps.create_release.outputs.url }} to environment variable RELEASE_URL
• Updated echo command to reference $RELEASE_URL instead of inline GitHub expression

- name: Release complete
  env:
    RELEASE_VERSION: ${{ steps.version.outputs.version }}
    RELEASE_URL: ${{ steps.create_release.outputs.url }}
  run: |
    echo "✅ Release process complete"
    echo "Version: v$RELEASE_VERSION"
    echo "Release URL: $RELEASE_URL"

This follows the same pattern as RELEASE_VERSION and eliminates the code injection attack surface by isolating GitHub expressions from shell execution context.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.