Using `xargs` to safely parse the `DEPENDENCIES` environment variable
prevented the shell from expanding globs (e.g., `dist/*.whl`). This
broke workflows that relied on wildcard patterns for passing locally
built wheel files to `pip`.

This commit delegates the installation step to a companion script
`scripts/install-dependencies.sh`. This script safely splits the
arguments, explicitly handles glob expansions for paths (restoring the
`*.whl` support), and proactively blocks unsafe dependencies (like
editable installs or requirement files) to ensure arbitrary code
execution from the checked-out PR context remains prevented.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>

Using `xargs` to safely parse the `DEPENDENCIES` environment variable
prevented the shell from expanding globs (e.g., `dist/*.whl`). This
broke workflows that relied on wildcard patterns for passing locally
built wheel files to `pip`.

This commit delegates the installation step to a companion script
`scripts/install-dependencies.sh`. This script safely splits the
arguments, explicitly handles glob expansions for paths (restoring the
`*.whl` support), and proactively blocks unsafe dependencies (like
editable installs or requirement files) to ensure arbitrary code
execution from the checked-out PR context remains prevented.