Refactor: tools: make cibsecret use best practices for shell scripts

... which makes shellcheck happier. Mainly this involves:

• quoting variables
• not using "local", which isn't portable to e.g. zsh
• using $(cmd) instead of cmd