Replace fmt.Sprintf string interpolation with GraphQL query variables
in getOwnerNodeId() to eliminate GraphQL injection risk. The owner
login is now passed as a variable (-f login=<owner>) instead of being
embedded directly into the query string.
This matches the pattern already used in validateOwner() and eliminates
alerts #651 and #652 (workflow-go-graphql-injection-sprintf).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings

…25bccd7f4885a0e3

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>