GHA: misc maintenance

[vszakats]

• add zizmor in pedantic mode.
• add comment saying why we need package: write perms.
• avoid GHA macros in shell commands. Pass them as envs instead.
• build_master_dev: delete duplicate steps saving cosign keys.
• build*: delete steps extracting cosign.pub.
  The file is in the git repo root.
• add typos-cli spellcheck job.
• set/adjust concurrency.
• prefer secrets.GITHUB_TOKEN over github.token.
  To match other curl repos and highlight its a secret.
• fix typos found.
• fix some issues reported by yamllint.
• 01-design.md: replace UTF-8 line-drawing chars with ASCII-7.
• fixup whitespace.
• replace grype and trivy curl-to-shell installers with Linuxbrew installs.
• pass secrets to podman and docker via stdin, also to avoid docker
  message:

  WARNING! Using --password via the CLI is insecure. Use --password-stdin.
  

• drop interim envs when passing creds to redhat-actions/podman-login.
  Tested OK via build_ci_multi_images.
• build_ci_multi_images:
  • make it work in PRs, without secrets.
  • split login tests into their own workflow.
  • add login test for ghcr.io.
  • add login test for ghcr.io without redhat-actions/podman-login.
  • drop empty build matrix.
• [WIP vv below]
• install first, then checkout source.

TODO: podman --version, docker --version