Sanitise environment variables against template injection

[agriyakhetarpal]

This is something I ought to have done in #148, but I later realised that this was risky, and it also fixes builds for packages outside of SciPy. Otherwise, it is possible for those with malicious intent to inject unsafe code into GHA runners. It doesn't directly affect us as the attack surface is low, but in this case it was a functional bug as well, as the backticks in the PR title were being interpreted literally in #149.

[github-actions]

Package Build Results

Total packages built: 28
Total build time: 0:02:41

Package Build Times (click to expand)

Package	Build Time
openssl	2m 37s
sqlite3	1m 15s
liblzma	1m 4s
test	26s
regex	13s
MarkupSafe	4s
pydoc_data	4s
pydecimal	4s
lzma	4s
ssl	4s
atomicwrites	3s
hashlib	3s
packaging	2s
pyparsing	1s
attrs	1s
pytz	1s
tblib	1s
iniconfig	1s
more-itertools	1s
pluggy	1s
six	1s
py	1s
micropip	1s
setuptools	1s
Jinja2	1s
pytest	1s
pytest-asyncio	0s
exceptiongroup	0s

Longest build: openssl (2m 37s)
Packages built in more than 10 minutes: 0