[code-scanning-fix] Fix go/unsafe-quoting: Escape single quotes in JSON data (#11382)

* Fix go/unsafe-quoting: Escape single quotes in JSON data

- Add proper shell escaping for JSON data embedded in environment variables
- Prevents potential command injection via single quotes in user data
- Fixes CodeQL alert #538 (Critical severity)
- Uses POSIX-compatible '\''escaping technique

Security: Addresses CWE-78, CWE-89, CWE-94

* Replace manual quote escaping with %q format specifier (#11386)

* Initial plan

* Use %q for JSON escaping in YAML dictionary values

Replaced manual single-quote escaping with Go's %q format specifier, which:
- Automatically handles all special characters and escaping
- Produces cleaner YAML with double quotes instead of single quotes
- Follows existing codebase patterns (e.g., add_comment.go)
- Simplifies code by removing manual string replacement logic

This addresses the feedback to use simpler escaping for JSON data in YAML dictionary values.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Replace manual quote escaping with %q format specifier for YAML encoding (#11392)

* Initial plan

* Recompile workflows after security fix

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

* Add changeset [skip-ci]

---------

Co-authored-by: Code Scanning Fixer Bot <code-scanning-bot@github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 4 people

.changeset/patch-escape-single-quotes-in-project-views.md

@@ -44,7 +44,8 @@ func (c *Compiler) buildUpdateProjectJob(data *WorkflowData, mainJobName string)
 		if err != nil {
 			return nil, fmt.Errorf("failed to marshal views configuration: %w", err)
 		}
-		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: '%s'\n", string(viewsJSON)))
+		// Use %q to properly quote and escape the JSON for YAML
+		customEnvVars = append(customEnvVars, fmt.Sprintf("          GH_AW_PROJECT_VIEWS: %q\n", string(viewsJSON)))
 	}
 
 	jobCondition := BuildSafeOutputType("update_project")