Prevent shell injection in action inputs

[0x2b3bfa0]

Usually, inputs of this GitHub Action will be hardcoded in the workflow file. However, it would be nice to handle untrusted input gracefully, just in case.

.github/workflows/example.yml

on: push
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: geomys/sandboxed-step@v1.2.0
        with:
          run: |
            SANDBOXED_SCRIPT_EOF
            curl https://filippo.io/ # runs outside sandbox
            <<SANDBOXED_SCRIPT_EOF
          disable-network: true