Update pre-commit actionlint hook to always install shellcheck, ensuring consistent behavior

[sirosen]

actionlint has a standing issue that the pre-commit configuration won't install shellcheck, but the tool will be picked up from your system if it is installed: rhysd/actionlint#477
This leads to discrepancies between local pre-commit runs, where, for example, I have shellcheck installed in ~/bin/, and pre-commit.ci, where shellcheck is missing.

There's a PR up which would (incorrectly) pull in shellcheck's latest version into the actionlint hook config, but an excellent comment from Alex Waygood explains why it's not quite right and links to Astral's config in the ruff repo.

I plan to both update the variable quoting issue I noted in our workflows (which makes shellcheck fail, even though the quoting is fine in practice) and update the pre-commit config based on the ruff one.