[MOL-22452] Remediate findings

[thanhpt0105-gt]

Type of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing apis or functionality to change)
• Documentation (change to documentation, comments or API descriptions)
• Tests (improvements to unit tests or E2E tests)
• Other (technical improvements, refactoring, or changes that don't fall into the above categories)

Description of changes
Link to [ticket] https://sgtechstack.atlassian.net/browse/MOL-22452
Description of changes:

• Prevent GitHub Actions script injection in trigger-gitlab-pipeline.yml by moving github.event.head_commit.message and github.ref_name from direct ${{ }} interpolation to env: block
• Replace execSync with execFileSync in codemod CLI to prevent command injection via shell metacharacters in target path
• Sanitize href in withNotificationBanner link attributes using DOMPurify.isValidAttribute to block javascript: and data: URLs

Checklist

• Changes follow the project guidelines in CONTRIBUTING.md and CONVENTIONS.md
• Looks good on mobile and tablet
• Updated documentation
• Added/updated unit tests
• Added/updated E2E tests

Screenshots