Harden project_command GraphQL construction against interpolation-based injection - #52758

Code scanning flagged workflow-go-graphql-injection-sprintf in pkg/cli/project_command.go for owner/project GraphQL lookups. This PR removes interpolation risk at those call sites by enforcing static GraphQL documents and variable-only input binding.

• Query construction hardening

  • Owner/project GraphQL documents are defined as static constants (no Sprintf/string concat in query text).
  • Runtime values (login, number) are passed only via GraphQL variables in the JSON request body.

• Call-site behavior

  • validateOwner, getOwnerNodeId, and getStatusField select from allow-listed static query templates by scope/type (org vs user) rather than constructing query strings dynamically.

• Regression guardrails

  • Focused tests assert:
    • query text does not include user input,
    • variables carry user-controlled values as data,
    • required variable declarations remain present in query constants.

const validateOrgOwnerQuery = `query($login: String!) { organization(login: $login) { id login } }`

_, err := runProjectGraphQLQueryWithVariables(ctx, "Validating owner...", validateOrgOwnerQuery, map[string]any{
    "login": owner,
})

• Fixes [uk-ai-resilience] [UK AI Governance] Verify/parameterize GraphQL query construction in project_command.go (code scanning warnings) #52749