readme: users do not need to execute the `gitlab:setup` rake task anymore
plug bash vulnerability by switching to dash shell