CI and runtime performance optimizations (#8624)

* CI and runtime performance optimizations

- Skip file CLI lint mode tests when list_of_files is also supported (ports #8410)
- Hand off the DEV Docker image to consumer jobs via ghcr.io for same-repo branches (artifact kept for forked PRs), with daily pruning of megalinter-dev images
- Build only per-linter images impacted by a PR's changed files, full matrix on any doubt
- Restrict MegaLinter self-lint and runner test workflows push trigger to main-line branches to remove duplicate push+PR runs
- Schedule fixer linters of a descriptor first, then run its check-only linters in parallel instead of serializing the whole descriptor group
- Report linter versions from a manifest baked at Docker build time; new VERSION_GET_AT_RUNTIME variable to force runtime collection (tests and auto-update job always do)
- Move TAP reporter golden tests from all generated linter test classes to a dedicated curated class, remove stale Super-Linter-era expected files

* Fix secretlint report-folder race and declare supported_cli_lint_modes on zizmor, shfmt, revive

- secretlint project-mode glob could pick transient report files written by
  linters running in parallel (jscpd-report.html), crashing with ENOENT:
  megalinter-reports/ is now in .secretlintignore
- zizmor, shfmt and revive were falling back to the file-only default of
  supported_cli_lint_modes, so their file lint mode tests ran while their
  real list_of_files runtime mode was never tested

* Fix brace-expansion CVE-2026-69152 in gherkin images, add ENOENT to cspell words

Top-level brace-expansion@1.1.18 install makes npm hoist and dedupe the
vulnerable 1.1.14 nested in gherkin-lint's glob/minimatch chain (verified
locally with npm ls). Manual pin on the 1.x line on purpose: 5.x would not
satisfy the nested ^1.1.x range and the dedupe would silently stop.

* Ignore CVE-2026-69152 in trivy instead of overriding brace-expansion

Follow-up of the already-ignored CVE-2026-14257: same expand() DoS class,
same non-exploitability reasoning (glob patterns only come from the repo's
own configuration, one-shot CI process). Reverts the top-level npm override.

* [MegaLinter] Apply linters fixes :)

* Use docker/login-action for ghcr pulls in DEV consumer jobs

Replaces the raw docker login (which warns about unencrypted credential
storage in the runner's config.json) and adds automatic logout in the
action's post step.

* CHANGELOG: measured before/after numbers for CI and runtime optimizations

---------

Co-authored-by: nvuillam <17500430+nvuillam@users.noreply.github.com>

Author: nvuillam