fix: use env var for PR title in commitlint workflow to prevent untrusted script injection

fix: use env var for PR title in commitlint workflow to prevent untrusted script injection #10578