fix(security): restrict release workflow to same-repo PRs and block env overrides for internal fields

fix(security): restrict release workflow to same-repo PRs and block env overrides for internal fields #8332