[CI] Pass script args using env var in merged PRs workflow (#199022)
As was done in #198160, address the problem described in
https://docs.github.com/en/actions/concepts/security/script-injections
using the solution recommended by
https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable.
Not all these inputs are untrusted, but I've applied it to all of them
just to be consistent.