scripts: use end-of-options marker in cd, mkdir, mv, sha256sum commands

[vszakats]

Where missing. To avoid passing an option by accident.

End-of-option marker (--) is not POSIX, but most of these scripts are
internal and/or CI-focused, where this is fine. maketgz and
verify-release are meant for public use, and I asses this is fine too,
but let us know if this causes issues in real world envs.

Also:

• maketgz: pass args with :? to rm -rf, where missing.
  Cannot cause an actual issue with current code.
• verified cp, rm instances too, but none were affected.
• tests/cmake/test.sh: replace $PWD with $(pwd) for sturdiness.
• appveyor.sh: replace $PWD with $(pwd) for sturdiness.

Assisted-by: Dan Fandrich
Follow-up to 6aab1dc #19450

---

• filter out cases where it's not necessary based on wider context.
  esp Makefile.am, maketgz and verify-release.
• double-check if -- is necessary/useful in the cd -- "$(dirname "$0")" command.
• split off unrelated "also" fixes into separate PR. → autotools: minor fixes and improvements #22154
• fix dist fallout due to dropping MANFILES.

move to #22154:

• tests/Makefile.am: drop unused remains of MANFILES.
  Follow-up to fa3f889 tests: move test docs into /docs #17463
• tests/Makefile.am: fix to dist-clean CLEANFILES. [WIP]
• tests/http/Makefile.am: add ./ prefix to glob passed to rm -rf.

[dfandrich]

NB -- to end arguments is not POSIX, so this will cause breakage on some systems.

[vszakats]

NB -- to end arguments is not POSIX, so this will cause breakage on some systems.

I suspect it may be an issue for Makefile.am cases in practice.
(curl-config is not affected). Some of the Makefile.am ones
could be removed after closer inspection, or maybe even all of
them to avoid issues – I'll review tomorrow. FTR there is already
one use in master, via 6aab1dc,
with no reports so far.

Then there is maketgz/verify-release, which I'll also review,
though I surmise they may be fine with this.

The others seem fine, as they are CI/developer/internal.

[vszakats]

After review, there is just one case left in Makefile.am,
in the same rule that already had one. I feel this is OK.

The rest is much reduced, in most cases to cd, and
a couple of others.

I'll move out not stritcly related updates to separate
PR(s). (some $?s may be overkill, but if not causing
issues I'd keep them for safety.)

[vszakats]

Turns out the remaining Makefile.am update is unnecessary as well.