CI: shellcheck: adjust for 'pmbootstrap ci' (MR 3608)

Split out the grep for CHANGEME into a separate .ci/grep.sh script, as
it's not related to shellcheck and also there's another grep check that
I'll move there in a follow-up patch.