Fix private key leaking into step logs

Composite actions substitute ${{ inputs.* }} directly into the run:
script source before execution, and the runner echoes that resolved
script at the top of the step log. Interpolating private_key and
transfers straight into the heredocs meant the raw SSH private key
was printed in plaintext on every run. Move both through env: and
reference them as shell variables instead, matching ssh-checkout and
ssh-command.

action.yml

@@ -25,22 +25,24 @@ runs:
   steps:
     - name: Execute SSH/SCP Transfers
       shell: bash
+      env:
+        PRIVATE_KEY: ${{ inputs.private_key }}
+        TRANSFERS: ${{ inputs.transfers }}
+        HOST: ${{ inputs.host }}
+        PORT: ${{ inputs.port }}
+        USERNAME: ${{ inputs.username }}
       run: |
         # 1. Create a secure temporary file for the SSH key
         SSH_KEY_PATH=$(mktemp)
-        cat << 'EOF' > "$SSH_KEY_PATH"
-        ${{ inputs.private_key }}
-        EOF
+        printf '%s\n' "$PRIVATE_KEY" > "$SSH_KEY_PATH"
         chmod 600 "$SSH_KEY_PATH"
 
         # 2. Add Host to known_hosts to prevent verification prompts
         mkdir -p ~/.ssh
-        ssh-keyscan -p ${{ inputs.port }} -H ${{ inputs.host }} >> ~/.ssh/known_hosts 2>/dev/null
+        ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
         # 3. Securely write transfers input to a file for parsing
-        cat << 'EOF' > transfers.txt
-        ${{ inputs.transfers }}
-        EOF
+        printf '%s\n' "$TRANSFERS" > transfers.txt
 
         # 4. Loop through each line and execute commands
         while IFS= read -r line || [ -n "$line" ]; do
@@ -58,11 +60,11 @@ runs:
             echo "::group::Transfer to $dest"
 
             echo "Creating remote directory: $dest"
-            ssh -i "$SSH_KEY_PATH" -p ${{ inputs.port }} ${{ inputs.username }}@${{ inputs.host }} "mkdir -p \"$dest\"" < /dev/null
+            ssh -i "$SSH_KEY_PATH" -p "$PORT" "$USERNAME@$HOST" "mkdir -p \"$dest\"" < /dev/null
 
             echo "Copying $src to $dest..."
             # Note: eval is used so wildcards or multiple space-separated files expand properly
-            eval "scp -r -i \"$SSH_KEY_PATH\" -P ${{ inputs.port }} $src \"${{ inputs.username }}@${{ inputs.host }}:$dest/\"" < /dev/null
+            eval "scp -r -i \"$SSH_KEY_PATH\" -P $PORT $src \"$USERNAME@$HOST:$dest/\"" < /dev/null
 
             echo "::endgroup::"
           fi