ci: prevent command injection in prevent-deletion workflow (#3138)

[ti-chi-bot]

This is an automated cherry-pick of #3138

First-time contributors' checklist

• I've signed Contributor License Agreement that's required for repo owners to accept my contribution.

What is changed, added, or deleted? (Required)

Which TiDB Operator version(s) do your changes apply to? (Required)

• main (the latest development version for v2.x)
• v2.0 (TiDB Operator 2.0 versions)
• release-1.x (the latest development version for v1.x)
• v1.6 (TiDB Operator 1.6 versions)
• v1.5 (TiDB Operator 1.5 versions)
• v1.4 (TiDB Operator 1.4 versions)
• v1.3 (TiDB Operator 1.3 versions)

What is the related PR or file link(s)?

• This PR is translated from:
• Other reference link(s):

[ti-chi-bot]

@Oreoxmt This PR has conflicts, I have hold it.
Please resolve them or ask others to resolve them, then comment /unhold to remove the hold label.

[ti-chi-bot]

@ti-chi-bot: ## If you want to know how to resolve it, please read the guide in TiDB Dev Guide.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.

[Oreoxmt]

/approve

[Oreoxmt]

/unhold

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Oreoxmt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Oreoxmt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment