Fix potential template injection in setup-env-file

[mandreko-bitwarden]

📔 Objective

This PR fixes some potential template injection in the setup-env-file action. It was using values directly from input which goes against best practices.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR remediates a potential GitHub Actions template-injection vulnerability (CWE-94) in the setup-env-file composite action. All ${{ }} expressions are moved out of the run: script body into an env: block and referenced as shell variables, which is GitHub's recommended mitigation. The .env generation is refactored into a single grouped redirect and which node is now safely quoted.

Code Review Details

No blocking findings. Verified:

• All Key Vault secrets and action inputs are correctly mapped to KV_*/IN_* env vars and referenced consistently in each echo line — no name mismatches.
• The single { ... } > .env block redirect preserves the original truncate-then-append behavior.
• "$(which node)" quoting is an improvement over the backtick form.
• The residual \"...\" wrapping of values is unchanged pre-existing behavior over trusted Bitwarden-controlled data, so it is out of scope for this fix.