fix: prevent code injection (#4327)

Description
---
Prevent code injection from PR titles.

How Has This Been Tested?
---
I've used `act` to test locally the pull request, with the code injection title.

.github/workflows/pr_title.yml

@@ -19,4 +19,6 @@ jobs:
           echo "module.exports = {extends: ['@commitlint/config-conventional']}" > commitlint.config.js
       - name: lint
         run: |
-          echo "${{github.event.pull_request.title}}" | commitlint
+          echo "$PR_TITLE" | commitlint
+        env:
+          PR_TITLE: ${{github.event.pull_request.title}}