Fix GitHub Actions security findings in e2e workflow

- S7630 (BLOCKER, script injection): bind inputs.test_names to a
  TEST_NAMES env var and reference it as a quoted shell variable instead
  of interpolating ${{ inputs.* }} directly into the run block.
- S7637 (MAJOR, unpinned action): pin gradle/actions/setup-gradle to the
  v4.4.4 commit SHA.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKxodNE4h3TsSHMqDEeC8v

Author: tastybento

.github/workflows/e2e.yml

@@ -38,7 +38,7 @@ jobs:
           node-version: 20
 
       - name: Set up Gradle (with caching)
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@748248ddd2a24f49513d8f472f81c3a07d4d50e1 # v4.4.4
 
       # Reuse the Paper jar + downloaded libraries and the BentoBox/BSkyBlock jars across runs.
       # plugwright's clean step preserves server.jar / cache / libraries, and build.gradle.kts
@@ -66,12 +66,15 @@ jobs:
         working-directory: e2e
         env:
           PLUGWRIGHT_DEBUG: "1"
+          # Bind the user-controlled input to an env var and reference it as a shell variable
+          # below — never interpolate ${{ inputs.* }} directly into a run block (script injection).
+          TEST_NAMES: ${{ inputs.test_names }}
         run: |
-          ARGS=""
-          if [ -n "${{ inputs.test_names }}" ]; then
-            ARGS="-PtestNames=${{ inputs.test_names }}"
+          if [ -n "$TEST_NAMES" ]; then
+            ./gradlew plugwrightTest "-PtestNames=$TEST_NAMES" --no-daemon
+          else
+            ./gradlew plugwrightTest --no-daemon
           fi
-          ./gradlew plugwrightTest $ARGS --no-daemon
 
       # Always upload the server log + any plugwright report so a regression is debuggable.
       - name: Upload server log & report