[1.5] ci: replace some third-party actions

[kolyshkin]

Backport of #5384 to release-1.5. Original description follows.

---

Two independent cleanups in the validate workflow, each replacing a
third-party action with a few lines in-tree.

1. commit job: simplify the subject length check

Replace two third-party actions (tim-actions/get-pr-commits and
tim-actions/commit-message-checker-with-regex) with a few lines of shell
using the GitHub API (based off of moby/moby#53327, thanks @thaJeztah!).
No checkout is needed at all, so no source reaches the runner.

Verified on this PR: the job concludes success in 3 steps and ~3s (down
from 5 steps and 4s with a shallow checkout), and a temporary commit with a
100-character subject was flagged (and only that one), exiting 1.

2. shellcheck job: drop lumaxis/shellcheck-problem-matchers

That action does nothing but ship a JSON file and echo an ::add-matcher::
command, so we now do that ourselves, with the matcher in
.github/shellcheck-tty.json.

Its matcher was also only annotating warning and error findings, for two
reasons: its severity capture group lists (note|warning|error), while
shellcheck severities are error, warning, info and style; and the
runner honors only error, warning and notice, silently skipping any
other match (Runner.Worker/Handlers/OutputManager.cs). As info and
style are the bulk of what shellcheck reports, most findings were never
annotated. Ours uses a fixed severity instead (any finding fails the job
anyway) and keeps the severity word in the message.

Verified on a fork PR, on a file with four shellcheck problems (one info,
one style, two warning):

• no matcher at all: no annotations, just the generic "Process completed with
  exit code 2";
• upstream matcher: 2 of 4 annotated;
• this one: all 4, at the right file and line.

Note that the usual gcc-format matchers have the same problem, as shellcheck -f gcc reports both info and style as note, which is not notice.

[thaJeztah]

LGTM