Run bash script tests under sh and add ShellSpec specs for bootstrap-salt.sh

[twangboy]

What does this PR do?

Phases 1 and 2 covered the PowerShell script. This PR improves how the bash script's functions are tested. Two things were weak: the function-level pytest tests ran under bash even though the script is POSIX sh, and there was no way to test a function with its package manager and network calls mocked.

Changes

1. pytest function tests now run under sh (tests/integration/test_installation.py)
   • bootstrap-salt.sh is POSIX sh, and Debian and Ubuntu run it under dash. Tests that extract functions and run them under bash could pass despite a bashism. They now use sh by default.
   • BOOTSTRAP_TEST_SHELL overrides the shell, for example dash.
   • On Windows the tests skip unless BOOTSTRAP_TEST_SHELL is set. Git's sh (Cygwin) has no default PATH for env -i sort, which the script uses, so the functions misbehave there even though real Linux is fine. Without the skip, the Windows CI job would have started running these tests and failed.
2. ShellSpec specs (.shellspec, tests/shell/)
   • The script runs from the top and calls exit, so it can't be sourced. A small awk helper extracts the named functions into a file the specs Include. This needs no refactor of the 9,000-line script.
   • repo_url_spec.sh covers __rewrite_repo_url, including & and # in the URL and a missing file. It also covers __install_saltstack_rhel_onedir_repository with mocked __fetch_url, yum and echowarn: a fresh install, an existing salt.repo without -F (left alone, with a warning), and -F with -R.
   • version_helpers_spec.sh covers __parse_version_string, __unquote_string, __camelcase_split and __derive_debian_numeric_version.
   • Mocking the fetch and the package manager lets us test the existing-file and -F paths without a container. That is what pytest couldn't do, and it is the kind of gap behind Custom repository URL not working for CentOS/Fedora #2135.
3. test-shell CI job
   • It installs ShellSpec 0.28.1 from its pinned git tag, not through an unpinned curl | sh, and runs the specs under dash and bash.
   • It is added to the ci.yml template and generator, and the regenerated ci.yml is included. The final pipeline status job requires it.

What issues does this PR fix or reference?

Phase 3 of #2139