CI: move shellcheck into dedicated workflow

[dannywillems]

Summary

• Move the shellcheck job out of the changelog workflow into its own
  dedicated shellcheck.yml workflow triggered on push
• The changelog workflow now only contains changelog-related checks

Test plan

• Verify the new shellcheck workflow runs on push
• Verify the changelog workflow still runs correctly without the
  shellcheck job