Sanitize branch ref handling in test workflow shell steps

[theinfosecguy]

Summary

• Move branch reference capture in test.yml into an explicit HEAD_REF environment variable.
• Write the branch output using printf with quoting so branch names are handled as plain data.
• Keep existing checkout metadata behavior while removing shell interpolation risk from direct expression expansion.

Testing Done

• Reviewed generated shell script behavior for the updated step.
• Verified change scope is limited to metadata output in test.yml.
• CI run validation in upstream repository by maintainers.

[ChrisCarini]

LGTM! Consider contributing this upstream, too!