Quote shell variables in setup action extraction path handling

[Copilot]

The composite action used unquoted shell variables in conditionals and file/path operations, which can trigger word splitting and pathname expansion in Bash. This updates the action to consistently quote those values in the install path for released binaries.

• What changed

  • Quote os in the macOS conditional.
  • Quote url in the release-install conditional.
  • Quote archive member and output path arguments during extraction and chmod.

• Related hardening

  • Quote the temporary directory in cd.
  • Quote PATH assignment and the GITHUB_PATH redirection target in the same block for consistent path handling.

• Example

  if [[ "$os" == "macOS" ]]; then
    os="Darwin"
  fi
  
  if [[ ! -z "${url}" ]]; then
    tar xzf "$fname" "${out}"
    chmod +x "${tmp}/${out}"
    echo "${tmp}" >> "$GITHUB_PATH"
  fi

[imjasonh]

Reported in https://github.com/chainguard-actions/imjasonh-setup-crane/blob/v0.6/HARDENING.md