fix: keep a step's own with: values out of its inputs context (#1192)

A step's `if:`, its `continue-on-error:` and its `run:` script resolved `inputs.*` from the step's own `INPUT_*` env. A `with:` key colliding with a workflow input flipped conditions, and any `INPUT_`-shaped variable from `env:` or a `GITHUB_ENV` write forged an input that never existed.

GitHub evaluates all three in the enclosing scope: the workflow inputs, or for a composite action's steps that action's inputs. Action-input interpolation is the one place that legitimately sees a step's own `with:`, so it keeps its own evaluator.

Fixes https://gitea.com/gitea/runner/issues/1191, ports https://github.com/nektos/act/pull/2473 and extends it to the pre and post stages.

---------

Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1192
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: ABiscuitttt <773542570@qq.com>

act/runner/testdata/uses-step-if-inputs-not-leaked/push.yml

@@ -0,0 +1,20 @@
+name: uses-step-if-inputs-not-leaked
+on:
+  push:
+  workflow_dispatch:
+    inputs:
+      no-cache:
+        type: boolean
+        default: false
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: uses-step-with-colliding-input-name
+        uses: docker://node:24-bookworm-slim
+        if: inputs.no-cache
+        with:
+          no-cache: ${{ inputs.no-cache || false }}
+          entrypoint: /bin/sh
+          args: -c 'exit 1'