ci: fix shellcheck issues in composite actions

actionlint only understands workflow files, so the .github/actionlint.yaml
ignore keeps the composite action definitions out of `make lint.workflows`.
Apply the same shellcheck fixes there anyway, found by running shellcheck over
their run: blocks directly:

- quote unquoted variable expansions (SC2086): the $GITHUB_ENV writes in
  collect-logs, tmate_debug and upterm_debug, and ${ARCH} in the cri-dockerd
  install in integration-test-setup-cluster-resources
- split `export BLOCK=$(...)` into a separate assignment and export so a
  failing command substitution is not masked (SC2155) in
  encryption-pvc-kms-ibm-kp

Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit 48dacb1894)

.github/workflows/upterm_debug/action.yml

@@ -13,7 +13,7 @@ runs:
       run: |
         # Enable upterm only in the main Rook repo, where the USE_TMATE secret is set in the repo, or if the action is re-run
         if [ "$GITHUB_REPOSITORY_OWNER" = "rook" ] || [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo ENABLE_UPTERM=1 >> $GITHUB_ENV
+          echo ENABLE_UPTERM=1 >> "$GITHUB_ENV"
         fi
 
     - name: set up upterm session