fix: close shell injection in upload_assets.cjs (incomplete fix from d07e64c) (#17736)

Author: Copilot

actions/setup/js/upload_assets.cjs

@@ -153,7 +153,7 @@ async function main() {
         fs.copyFileSync(assetSourcePath, targetFileName);
 
         // Add to git
-        await exec.exec(`git add "${targetFileName}"`);
+        await exec.exec("git", ["add", targetFileName]);
 
         uploadCount++;
         hasChanges = true;