Set up Shellcheck/dependabot

This requires manual setup as seen [here](https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/dependabot-quickstart-guide#enabling-dependabot-for-your-repository), which is also in place in the docker repo. I did a first draft, which I did not test stand-alone, but within the old chain. https://github.com/droid-legacy/android_vendor_partner_gms/tree/style The dependabot part is confirmed working, but has to be in place in the master branch to do stuff. What I can still put in place is: [auto-assign petefoth on pr](https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/customizing-dependabot-prs#automatically-adding-assignees) [auto-merge in actions-staging branch (tbh)](https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/automating-dependabot-with-github-actions#enabling-automerge-on-a-pull-request)