GitLab CI: add shellcheck, androguard <4, silence irrelevant bandit error, enable macOS job

This is some CI improvement and maintenance. Also, fdroidserver has been maintained in Homebrew for years, so there are macOS users. gitlab.com provides us free macOS runner access, so this revives the old Travis CI job as a GitLab CI job. I'm currently thinking that this would only be run on master, like the Fedora job. So not on merge requests, so that contributors only have to think about free software when submitting merge requests.