OpenChoreo Workflow Plane templates patched for OS command injection vulnerability

According to the GitHub Security Advisory database, OpenChoreo has addressed a high-severity vulnerability (GHSA-2mw5-23gm-pccq) in its Workflow Plane templates. The issue stemmed from OS command injection risks caused by the direct interpolation of developer-controlled workflow parameters into shell scripts executed via `sh -c`. This allowed authenticated users with permission to configure and trigger workflows to craft malicious parameter values containing shell metacharacters, enabling arbitrary command execution within workflow pods.

The vulnerability was exacerbated in configurations where privileged Podman containers were used without Kubernetes pod user-namespace isolation. In such cases, injected commands could execute as UID 0 inside the container, with UID 0 mapped into the host user namespace, significantly increasing the impact. The remediation modifies how workflow parameters are handled, ensuring they are passed as data rather than executable shell syntax. Parameters are now quoted and passed through `container.env`, while JSON-derived variables are handled as separate argument-vector entries.

Operators should carefully review their workflow configurations before upgrading, especially if privileged Podman containers were used or if workflows relied on specific shell-based parameter handling. Any workflows that depend on the previous interpolation behavior may break due to the stricter handling of parameters as data. Additionally, operators should verify that `hostUsers: false` is enabled in their Kubernetes configurations to mitigate risks associated with UID mapping in privileged containers.