fix: mitigate command injection risk in background tasks workflow

[MatrixNeoKozak]

In the GitHub Actions workflow BackgroundTasks.yml, the Save payload data step expands the PayloadJson environment variable directly in a bash command via echo $PayloadJson. Because this workflow is triggered on pull_request_target, an external contributor can control properties within the github context (such as pull request titles, descriptions, or branch names). If any of these fields contain special characters like semicolons, backticks, or shell evaluation sequences, they are evaluated by the shell, leading to a command injection vulnerability. This is resolved by writing the environment variable directly using printenv PayloadJson > ./pr/PayloadJson.json, which avoids shell evaluation of the variable's contents.

[learn-build-service-prod]

Learn Build status updates of commit 6dcc62e:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/BackgroundTasks.yml	✅Succeeded

For more details, please refer to the build report.