ci: avoid direct use of untrusted PR metadata (#14232)

Author: royy92

.github/workflows/deploy.yml

@@ -66,10 +66,13 @@ jobs:
 
       - name: Save PR metadata
         if: github.event_name == 'pull_request'
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_REF: ${{ github.head_ref }}
         run: |
           mkdir -p pr-metadata
-          echo "${{ github.event.pull_request.number }}" > pr-metadata/pr_number
-          BRANCH="${{ github.head_ref }}"
+          echo "$PR_NUMBER" > pr-metadata/pr_number
+          BRANCH="$HEAD_REF"
           # Sanitize branch name into a valid Wrangler preview alias.
           # Wrangler validates aliases against /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/i so the
           # alias must start with a letter, contain only [a-z0-9-], and end with a letter