Harden perf-comment workflow inputs

[vineethkuttan]

Description

Follow GitHub's recommended best practices for workflow_run triggered workflows that consume artifacts from untrusted runs.

Type of Change

• Validate PR number: Add a strict numeric check (^[1-9][0-9]*$) in the shell step before setting the output, so malformed artifact data is rejected early.
• Use environment variables instead of expression interpolation: Pass `PR_NUMBER and REPORT_PATH via env: block instead of inlining ${{ }} expressions in the actions/github-script body. This aligns with the GitHub security hardening guide for github-script.
• Add defense-in-depth integer check in JS: Validate prNumber is a positive integer before using it in API calls.

Changelog

Should this change be included in the release notes: no

Microsoft Reviewers: Open in CodeFlow