CI/BLD: Restrict ci/code_checks.sh to tracked repo files
- [x] closes #36368 
- [x] passes `git diff upstream/master -u -- "*.py" | flake8 --diff`

Previously, some of the checks in `code_checks.sh` ran unrestricted on all the
contents of the repository root (recursively), so that if any files extraneous
to the repo were present (e.g. a virtual environment directory, or generated source files), they were
checked too, potentially causing many false positives when a developer runs
`./ci/code_checks.sh` locally to check that the code is ready to be put in a PR.

The checker invocations that were already scoped (i.e. they were already
restricted, in one way or another, to the actual pandas code, e.g. by
restricting the search to the `pandas` subfolder) have been left as-is,
while those that weren't are now given an explicit list of files that are
tracked in the repo.
