CI: Address actionlint/shellcheck and zizmor issues in create_release_draft.yml workflow

Author: echoix

.github/workflows/create_release_draft.yml

@@ -41,12 +41,12 @@ jobs:
           python-version: '3.13'
       - name: Create output directory
         run: |
-          mkdir ${{ env.OUT_DIR }}
+          mkdir "${OUT_DIR}"
       - name: Generate ChangeLog file
         run: |
           python utils/gitlog2changelog.py
-          mv ChangeLog ${{ env.OUT_DIR }}/ChangeLog
-          gzip ${{ env.OUT_DIR }}/ChangeLog
+          mv ChangeLog "${OUT_DIR}/ChangeLog"
+          gzip "${OUT_DIR}/ChangeLog"
       - name: Generate Git derived data files
         run: |
           echo "Generate VERSION_GIT file:"
@@ -58,21 +58,21 @@ jobs:
           echo "Create core modules patch file:"
           git add core_modules_with_last_commit.json
           git diff --cached > \
-            ${{ env.OUT_DIR }}/core_modules_with_last_commit.patch
+            "${OUT_DIR}/core_modules_with_last_commit.patch"
       - name: Create tarballs (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         run: |
           cd ..
-          tar -cvf ${{ env.OUT_DIR }}/${{ env.GRASS }}.tar \
+          tar -cvf "${OUT_DIR}/${GRASS}.tar" \
             --exclude=".gi*" --exclude=".tr*" \
-            --transform s/grass/${{ env.GRASS }}/ grass
-          cd ${{ env.OUT_DIR }}
-          gzip -9k ${{ env.GRASS }}.tar
-          md5sum ${{ env.GRASS }}.tar.gz > ${{ env.GRASS }}.tar.gz.md5
-          sha256sum ${{ env.GRASS }}.tar.gz > ${{ env.GRASS }}.tar.gz.sha256
-          xz -9e ${{ env.GRASS }}.tar
-          md5sum ${{ env.GRASS }}.tar.xz > ${{ env.GRASS }}.tar.xz.md5
-          sha256sum ${{ env.GRASS }}.tar.xz > ${{ env.GRASS }}.tar.xz.sha256
+            --transform s/grass/"${GRASS}"/ grass
+          cd "${OUT_DIR}" || exit
+          gzip -9k "${GRASS}.tar"
+          md5sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.md5"
+          sha256sum "${GRASS}.tar.gz" > "${GRASS}.tar.gz.sha256"
+          xz -9e "${GRASS}.tar"
+          md5sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.md5"
+          sha256sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.sha256"
       - name: Publish draft distribution to GitHub (for tags only)
         if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2