Add actionlint checks for GitHub Actions

[AlexWaygood]

Add actionlint with ShellCheck to catch workflow syntax and shell-script errors, and update the existing workflows to pass the new checks.

The findings in tests.yml, daily.yml, stubtest_third_party.yml, and mypy_primer.yml came from actionlint's ShellCheck integration:

• SC2086: unquoted variable expansions. Package and stub lists relied on implicit word splitting and were also subject to filename expansion; scalar values such as $GITHUB_SHA, $MYPY_VERSION, $GITHUB_ENV, and $GITHUB_PATH were unquoted too. The PR quotes scalar values and passes lists through quoted array expansions. Package requirements are read one line at a time, preserving spaces and wildcard characters within each requirement; the array-building loops also work with macOS's Bash 3.2.
• SC2059: variable content in printf format strings; SC2001: unnecessary sed substitutions. Package logging used echo | sed to build an indented list and interpolated it into the format string, where % or backslashes in package names could be interpreted by printf. The PR prints each array element with the fixed format printf ' %s\n', removing the echo | sed pipeline.
• SC2162: read without -r. The loop collecting changed stubs could interpret backslashes in its input. It now uses IFS= read -r to read each line literally.
• SC2196: deprecated egrep. The changed-stub filter now uses grep -E instead.

The pre-commit hook hit pre-commit.ci's 180-second timeout, so actionlint runs in a dedicated GitHub Actions workflow using its official prebuilt Docker image, which includes ShellCheck.

Stacked on #16314.

[AlexWaygood]

Example of what a failing run looks like: https://github.com/python/typeshed/actions/runs/33195282726/job/98930729363?pr=16316

[AlexWaygood]

(I updated the PR description with details of exactly what's being fixed here)

[github-actions]

According to mypy_primer, this change has no effect on the checked open source code. 🤖🎉

[srittau]

Nit (which I hope renovate handles correctly):

Suggested change

	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

[srittau]

Why do we need this? I assume this was flagged due to white space handling. But since package names can not contain white space, I think this only complicates the action unnecessarily and makes it harder to understand and verify its correctness.

(Same pattern a few times below.)