feat: enable all optional shellcheck validations

Make shell a little bit safer with:

- add-default-case
- check-extra-masked-returns
- check-set-e-suppressed
- quote-safe-variables
- check-unassigned-uppercase

Although there are some stylistic decisions for uniformity:

- avoid-nullary-conditions
- deprecated-which
- require-variable-braces

scripts/setup.sh

@@ -6,8 +6,11 @@
 
 set -eu
 
-test "$(hostname)" = "dom0" || { echo "Must be run from dom0" >&2; exit 1; }
-test "$(id -u)" = "0" || exec sudo "${0}"
+# shellcheck disable=3028
+hostname="$(hostname)}"
+test "${hostname}" = "dom0" || { echo "Must be run from dom0" >&2; exit 1; }
+uid="$(id -u)"
+test "${uid}" = "0" || exec sudo "${0}"
 
 group="qusal"
 file_roots="/srv/salt/${group}"