ci: check the shell scripts with shellcheck

The chart ships shell scripts into the init containers, where a quoting or exit code bug surfaces as a broken
deployment rather than as a failing test. The bats suite covers the behaviour of config_environment.sh, but not the
classes of defects a static analyser catches, so shellcheck runs alongside it now.

The action is pinned to a commit sha, as the other actions of this workflow already are. Note that the tag is named
`2.0.0` and not `v2.0.0`, so the version comment deviates from the usual `# v<version>` form.

Submodules are deliberately not checked out. The action scans the whole working directory, and bats-core alone would
contribute several hundred files that are not ours to fix.

Co-authored-by: Copilot <copilot@github.com>

.gitea/workflows/bash.yaml

@@ -21,3 +21,9 @@ jobs:
           TERM: xterm
       name: Run bash unittests
       run: make bash/unittest
+
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0