Pass the test JDK's path to the build as a variable

The JDK jobs in ci.yml put ${{ steps.test-jdk.outputs.path }}, the
path actions/setup-java reports, straight into the build's shell
script. zizmor (template-injection) flags that: a template expansion is
pasted into the script before the shell runs it, so a value with shell
syntax in it would run as code. The path now reaches the shell as
TEST_JDK in the step's environment and is quoted there. The matrix
values stay inline: they are fixed in the workflow itself, and zizmor
does not flag them.

Author: abashev

.github/workflows/ci.yml

@@ -89,11 +89,14 @@ jobs:
           REASON: ${{ matrix.gradle_args_reason }}
         run: echo "::notice title=JDK ${{ matrix.jdk }} runs with $GRADLE_ARGS::$REASON"
 
-      # Gradle does not look into the runner's tool cache, so it is told where the test JDK is.
+      # Gradle does not look into the runner's tool cache, so it is told where the test JDK is. The path is
+      # a step's output, so it reaches the shell as a variable rather than being pasted into the script.
       - name: Build
+        env:
+          TEST_JDK: ${{ steps.test-jdk.outputs.path }}
         run: >-
           ./gradlew test -PjavaRuntime=${{ matrix.jdk }} ${{ matrix.gradle_args }}
-          -Porg.gradle.java.installations.paths=${{ steps.test-jdk.outputs.path }}
+          -Porg.gradle.java.installations.paths="$TEST_JDK"
 
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6.5.0