feat(lint): add upload-sarif input to skip GitHub code scanning upload

[DevSecNinja]

Problem

The reusable lint.yml workflow's checkov, trivy, and zizmor jobs always upload their results via github/codeql-action/upload-sarif, which requires GitHub Advanced Security (code scanning). On private repos without GHAS, the upload step fails with:

Error: Resource not accessible by integration

…which fails the whole lint job — even when the scanners themselves found nothing. There was no way to opt out of the SARIF upload, so these three security scanners were effectively unusable on private repos without a GHAS license.

Solution

Add a new upload-sarif input (boolean, default true — fully backward-compatible):

• true (default): unchanged behavior — scanners emit SARIF and upload to GitHub code scanning.
• false: the checkov/trivy/zizmor jobs run with console output and gate on their exit codes instead of uploading SARIF. Findings still block the build (when lint-fail-on-error: true); results appear in the job logs instead of the Security tab.

Each job branches internally on the input (single run step), and the Upload SARIF report steps are guarded with if: ${{ ... && inputs.upload-sarif }}.

Notes

• Callers still grant security-events: write (job permissions are static and can't be conditional), but no upload — and therefore no GHAS — is required when upload-sarif: false.
• workflow-templates/lint.yml documents the new input.
• Validated locally: actionlint, yamllint (central config), and zizmor all pass on the edited workflow.

Motivation

Unblocks the private DevSecNinja/second-brain repo (no GHAS) from adopting the org-standard security lint (see DevSecNinja/second-brain#11).