Fix: GitHub workflow script injection

[joycebrum]

Hi! I'm Joyce from Google's Open Source Security Team(GOSST) and I'm here to suggest this small fix to prevent from script injection attacks through your GitHub workflows.

You can see further explanation about this kind of threat in this blogpost Keeping your GitHub Actions and workflows secure Part 2: Untrusted input.

Any questions, let me know!

Summary of changes

• parse github.head_ref to an envvar to prevent from potential script injection.

PR checklist for schema changes

Not changing any schemas

• Update the version string in docs/source/conf.py and common/namespace.yaml to the next version with the suffix "-alpha"
• Add a new section in the release notes for the new version with the date "Upcoming"
• Add release notes for the PR to docs/source/hdmf_common_release_notes.rst and/or
  docs/source/hdmf_experimental_release_notes.rst

[rly]

Thank you @joycebrum . The fix looks good to me.