fix(flag): validate template file extension

[DmitriyLewen]

Description

This PR adds security validation to the --template flag to prevent arbitrary file disclosure. Previously, users could specify any file path (e.g., @/etc/passwd) as a template, and Trivy would read and potentially expose its contents in the
report output. Now, template files must have the .tpl extension.

Changes

• pkg/flag/report_flags.go: Added validation logic that checks if a template file path (prefixed with @) has the .tpl extension. The validation only triggers when --format template is specified.
• pkg/flag/report_flags_test.go: Added test cases covering:
  • Valid .tpl template files are accepted
  • Files without .tpl extension are rejected with an error
  • Files with wrong extensions (e.g., .txt) are rejected
  • Inline templates (without @ prefix) continue to work
• docs/: Updated CLI documentation for all commands using --template flag to indicate the .tpl extension requirement
• schema/trivy-config.json: Updated schema description for the template field

Benefits

• Security: Prevents information disclosure by restricting template files to .tpl extension only
• Clear error messages: Users get an explicit error when attempting to use non-.tpl files
• Backward compatible: Inline templates and existing .tpl files continue to work without changes
• No false positives: Validation only applies when --format template is actually used

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

Reopened from #10220 after recreating the fork.