GNUmakefile: slightly better structure

clumping all `.PHONY: whatever` lines together at the end of
the makefile is a good way to get them out of sync with actual
phony targets.
bsu_osc_build: new configuration variable

the difference between empty and populated `$bsu_osc_build` is::

  --- tests/630-build-success/tape.expected
  +++ tests/650-osc-build-args/tape.expected
  @@ -15,7 +15,7 @@
   sed -ri "/^[ \t]*#/!s/__VERSION__/12.34/" pkg.spec
   command osc -A obs st pkg.spec
   test 1 -eq 1
  -command osc -A obs build
  +command osc -A obs build Arch_Extra x86_64 PKGBUILD
   test 1 -eq 1
   command osc -A obs ci -m "Update to version 12.34"
   rm -rf /tmp/fake-tmp-dir
the shebang says zsh

this should simplify support for multiple package descriptions
such as PKGBUILD files (ArchLinux packages).

the absence of arrays in sh makes dealing with multiple values
(think `extract $tarball $paths`) difficult and awkward; bash
adds too little value for the price of leaving the POSIX subset.

implementation notes:

* nonomatch, nonullglob (NO_NOMATCH, NO_NULL_GLOB) behaviors
  are expected by both code and tests.
* zsh does not run the EXIT trap when bailing out through ERR_EXIT,
  it does run the ZERR trap.
* exithook now normalizes the exitcode to [0, 1] since zsh passes
  the actual exit code of the failed command to the ZERR trap.
  this showed up in tests/580-tarball-hook-failure: this test
  defines a bsu_tarball_hook which returns 3, yet in sh the trap
  code received 1 in $?.
* function body-trailing redirections are not special in zsh,
  they're active while the function statement is executed,
  not when the function runs.