Address shellcheck notices in nancy run.sh

SC2292: use \`[[ ]]\` instead of \`[ ]\` for the bash conditional.
SC2250: brace the variable references on the username/token args.

Trunk Check (threshold: trunk=high) escalates shellcheck notices to
failures, so the bash gating block Eli added in b35325e is breaking
Trunk Check across the PR.

Author: claude

linters/nancy/run.sh

@@ -4,8 +4,8 @@ set -eu
 
 set -- --output=json --skip-update-check
 
-if [ -n "${OSS_INDEX_USERNAME-}" ] && [ -n "${OSS_INDEX_TOKEN-}" ]; then
-  set -- "$@" --username "$OSS_INDEX_USERNAME" --token "$OSS_INDEX_TOKEN"
+if [[ -n ${OSS_INDEX_USERNAME-} && -n ${OSS_INDEX_TOKEN-} ]]; then
+  set -- "$@" --username "${OSS_INDEX_USERNAME}" --token "${OSS_INDEX_TOKEN}"
 fi
 
 go list -json -deps ./... | nancy sleuth "$@"