AI review: inputs.prompt injection sink + plugins/claude_args passthrough

[Oppen]

Two items surfaced while extending the AI-review workflows. Both are
org-security-posture calls rather than quick fixes, so filing for discussion
rather than patching inline.

1. inputs.prompt interpolated into run: scripts (command injection)

ai-review-claude.yml and ai-review-kimi.yml set INPUT_PROMPT as an env var
but then still interpolate ${{ inputs.prompt }} directly into the heredoc body
of the "Load prompt" step:

env:
  INPUT_PROMPT: ${{ inputs.prompt }}
run: |
  if [ -n "$INPUT_PROMPT" ]; then
    cat << 'PROMPT_EOF' > /tmp/prompt.txt
  ${{ inputs.prompt }}          # <-- interpolated into the script, not read from env
  PROMPT_EOF

The env var defeats the purpose if the value is also interpolated. Risk is low
today (callers are trusted, same-repo only), but it's a latent injection sink
and an easy fix: read from $INPUT_PROMPT instead of interpolating. Codex uses
PROMPT="${{ inputs.prompt }}", same issue.

2. Expose plugins / claude_args passthrough (feature)

The Claude wrapper hardcodes claude_args (model/max-turns/allowedTools) and
does not forward plugins / plugin_marketplaces, which the underlying
anthropics/claude-code-action@v1 supports. Downstream repos can't enable
plugins/skills or pass extra CLI args (e.g. --append-system-prompt,
--mcp-config) without forking the wrapper.

Proposed (all default to current behavior, zero impact on existing callers):

• add an optional extra_claude_args input appended to the hardcoded block;
• forward plugins and plugin_marketplaces inputs to the action.

Happy to PR #2 if there's appetite; #1 should probably just be fixed.