Extend shellcheck excludes for OpenWrt rc.common and ash conventions

The package-openwrt.yml shellcheck step was failing on warnings that
are false positives for OpenWrt scripts:

  SC2034 — USE_PROCD, START, STOP in /etc/init.d scripts are read by
           rc.common, not by the script itself; standard shellcheck
           cannot see the indirection.

  SC3043 — `local` is undefined in strict POSIX sh, but OpenWrt uses
           ash which supports it. The init scripts use `local`
           extensively for parameter scoping.

  SC2086, SC2089, SC2090 — firewall.sh constructs nft match clauses
           with literal quotes that need to survive variable expansion
           (`match='iifname "$TUN"'` then `nft ... $match accept`). The
           lack of double-quoting around `$match` is intentional so
           word-splitting yields separate nft arguments.

Adding these to the exclude list. SC2317 (unreachable code) and
SC1008 (rc.common shebang form) were already excluded.

.github/workflows/package-openwrt.yml

@@ -233,7 +233,7 @@ jobs:
               continue
             fi
             echo "==> shellcheck $f"
-            if shellcheck --shell=sh --exclude=SC1008,SC2317 "$f"; then
+            if shellcheck --shell=sh --exclude=SC1008,SC2317,SC2034,SC3043,SC2086,SC2089,SC2090 "$f"; then
               echo "    PASS"
             else
               echo "    FAIL"