fix: use env var indirection for inputs.components (CMD_EXEC)

[nbuckwalt]

Security Fix: CMD_EXEC via inputs.components

Summary

`inputs.components` is directly interpolated into a `run:` shell command via a GitHub Actions expression:
```
echo "downgrade=${{steps.parse.outputs.toolchain == 'nightly' && inputs.components && ' --allow-downgrade' || ''}}" >> $GITHUB_OUTPUT
```
A caller passing a malicious value such as `'; arbitrary_command; echo '` as `components` would execute arbitrary shell code in any job using this action.

Fix

Replace the inline expression with equivalent shell logic using `env:` variables (`TOOLCHAIN`, `COMPONENTS`). Output behavior is identical: ` --allow-downgrade` (with leading space) when toolchain is `nightly` and components is non-empty, empty string otherwise.

References

• GitHub Security Lab: Preventing pwn requests
• Rule: CMD_EXEC (CRITICAL)

🤖 Generated with Claude Code