scripts: use end-of-options marker in cd, mkdir, mv, sha256sum commands

Where missing. To avoid passing an option by accident.

End-of-option marker (`--`) is not POSIX, but most of these scripts are
internal and/or CI-focused, where this is fine. `maketgz` and
`verify-release` are meant for public use, and I asses this is fine too,
but let us know if this causes issues in real world envs.

Also:
- maketgz: pass args with `:?` to `rm -rf`, where missing.
  Cannot cause an actual issue with current code.
- verified `cp`, `rm` instances too, but none were affected.
- tests/cmake/test.sh: replace `$PWD` with `$(pwd)` for sturdiness.
- appveyor.sh: replace `$PWD` with `$(pwd)` for sturdiness.

Assisted-by: Dan Fandrich
Follow-up to 6aab1dc263 #19450

Closes #22150

scripts/cmakelint.sh

@@ -41,7 +41,7 @@
 
 set -eu
 
-cd "$(dirname "$0")"/..
+cd -- "$(dirname "$0")"/..
 
 {
   if [ -n "${1:-}" ]; then

scripts/maketgz

@@ -180,7 +180,7 @@ fi
 
 retar() {
   tempdir=$1
-  rm -rf "$tempdir"
+  rm -rf "${tempdir:?}"
   mkdir "$tempdir"
   cd "$tempdir"
   gzip -dc "../$targz" | tar -xf -
@@ -188,7 +188,7 @@ retar() {
   tar --create --format=ustar --owner=0 --group=0 --numeric-owner --sort=name curl-* | gzip --best --no-name > out.tar.gz
   mv out.tar.gz ../
   cd ..
-  rm -rf "$tempdir"
+  rm -rf "${tempdir:?}"
 }
 
 retar ".tarbuild"
@@ -218,14 +218,14 @@ gzip -dc "$targz" | xz -6e - > "$xz"
 # Now make a zip archive from the tar.gz original
 #
 makezip() {
-  rm -rf "$tempdir"
+  rm -rf "${tempdir:?}"
   mkdir "$tempdir"
   cd "$tempdir"
   gzip -dc "../$targz" | tar -xf -
   find . | sort | zip -9 -X "$zip" -@ >/dev/null
   mv "$zip" ../
   cd ..
-  rm -rf "$tempdir"
+  rm -rf "${tempdir:?}"
 }
 
 zip="curl-$version.zip"

scripts/perlcheck.sh

@@ -30,7 +30,7 @@
 
 set -eu
 
-cd "$(dirname "$0")"/..
+cd -- "$(dirname "$0")"/..
 
 procs=6
 command -v nproc >/dev/null && procs="$(nproc)"

scripts/verify-release

@@ -63,7 +63,7 @@ mkdir -p _tarballs
 rm -rf _tarballs/*
 
 # checksum the original tarball to compare with later
-sha256sum "$tarball" >_tarballs/checksum
+sha256sum -- "$tarball" >_tarballs/checksum
 
 # extract version number from file name
 tarver=$(echo "$tarball" | sed 's/curl-\([0-9.]*\)\..*/\1/')
@@ -85,7 +85,7 @@ if test "$withgit" = 0; then
   tar xf "$tarball"
 
   # move away the original tarball
-  mv "$tarball" "_tarballs/orig-$tarball"
+  mv -- "$tarball" "_tarballs/orig-$tarball"
 
   pwd=$(pwd)
   cd "curl-$curlver"
@@ -101,7 +101,7 @@ else
   echo "*** Use git tag $tag"
 
   # move away the original tarball
-  mv "$tarball" "_tarballs/orig-$tarball"
+  mv -- "$tarball" "_tarballs/orig-$tarball"
 
   prevtag=$(git symbolic-ref -q --short HEAD || git rev-parse HEAD)
   git checkout -f "$tag"