GHA: enclose if expressions in ${{ }} where missing

Enclosing expressions in `${{ }}` is optional, but sometimes required.
It seems more straighforward to use it always rather than decide on
a case-by-case basis. Before this patch 71 `if`s were enclosed and 49
were not. Enclosing these makes it easy to grep and recognize these
whereever used.

https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/using-conditions-to-control-job-execution

Closes #17550

.github/workflows/non-native.yml

@@ -333,7 +333,7 @@ jobs:
           echo '::group::brew packages installed'; ls -l /opt/homebrew/opt; echo '::endgroup::'
 
       - name: 'cache libressl'
-        if: contains(matrix.build.install_steps, 'libressl')
+        if: ${{ contains(matrix.build.install_steps, 'libressl') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-libressl
         env:
@@ -343,7 +343,7 @@ jobs:
           key: iOS-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
 
       - name: 'build libressl'
-        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true' }}
         run: |
           curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" | tar -x