fix: move github.event.pull_request.base.ref into env var in bootstrap-template-protection workflow

[sai-ray]

Fixes #

The upgrade workflow fails when it updates cdklabs-projen-project-types to a newer version. A check added in cdklabs/cdklabs-projen-project-types#957 refuses to let any workflow put ${{ github.event.* }} values straight into a shell command, because that data comes from the pull request and could be used to sneak in unwanted commands.

The "Checkout base branch" step in the bootstrap-template-protection workflow used the branch name directly in its command:

run: git fetch origin ${{ github.event.pull_request.base.ref }}

Every other step in the same file already passes this value in through an environment variable.

This PR passes the branch name in as an environment variable and uses it in the command, the same way the neighboring steps do:

name: 'Checkout base branch',
env: {
  BASE_REF: '${{ github.event.pull_request.base.ref }}',
},
run: 'git fetch origin "$BASE_REF"',

Checklist

• This change contains a major version upgrade for a dependency and I confirm all breaking changes are addressed
  • Release notes for the new version:

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.67%. Comparing base (c670960) to head (74c0278).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1744      +/-   ##
==========================================
+ Coverage   89.59%   89.67%   +0.07%     
==========================================
  Files          78       78              
  Lines       11796    11796              
  Branches     1657     1662       +5     
==========================================
+ Hits        10569    10578       +9     
+ Misses       1198     1189       -9     
  Partials       29       29              

Flag	Coverage Δ
suite.unit	89.67% <ø> (+0.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.