17.6.1.165-x86

Re-organize build scripts, add to shellcheck (#2380)

* ansible: Delete ansible.cfg

I noticed that ansible.cfg isn't used anywhere in the repo so can go
away.

* scripts: Move useful scripts into ebssurrogate/scripts, delete the rest

Most of these files aren't being used so no point having them in the
tree. Its a little weird to have cleanup-qemu.sh in ebssurrogate subdir
but there's already one file there so meh.

I deleted ebssurrogate/USAGE.md because its woefully out-of-date and I
will soon have a PR that builds the image with one simple
trick^Wcommand.

* Simplify scripts and make shellcheck happy

These are all pretty mechanical cleanups/simplifications + making
shellcheck happy. Using <<- flavored heredocs is nice to have because we
get better indentation based code scanning. I used [[ ]] and (( ))
bashism because they are better than POSIX they replace.

I also dropped unnecessary `${}` and `var="..."` for both consistency
and because I like it better that way :D. The real reason is I think
over-user of `${}` can lead to thinking its same as `"$"` for safety (
its not) and also tends to lead to inconsistent use. Variable assignment
doesn't need quotes because expansion does not take place in bash.

sudo/su isn't needed in many of the invocations, most of the scripts are
run as root, all except for nix-provision.sh. Almost every command in
nix-provision.sh is run with sudo so I changed packer to run the whole
script with sudo instead, like done for stage1.

* nix: Add shellcheck to git-hooks

I'm dropping check-shellscripts.yml since nix/hooks.nix is now a
superset. This means that I need a new GHA job to collect the matrix
jobs so that we can change the branch protection check to this. Can't
use `pre-commit-run (*)` because they don't exist on re-builds due to
nix caching and can't use the `no checks to build (*)` because it
doesn't exist when there are checks to build/run... :D