[predictor2718]

Adds glsec as a linter. I maintain glsec; it is a security linter for GitLab CI/CD pipelines, for GitLab what zizmor and actionlint are for GitHub Actions. It reports mutable images and includes, script injection through branch names and commit messages, secrets in variables:, unprotected deployments and similar issues.

Notes on the definition:

• Downloads the release archive from GitHub (tar.gz for Linux and macOS, zip for Windows, amd64 and arm64), set up like grype.
• New file type gitlab-ci in the plugin, as renovate does for its config: .gitlab-ci.yml and anything ending in .gitlab-ci.yml.
• Runs glsec --format sarif --no-color ${target}. glsec exits 1 when it finds error-level issues, so success_codes: [0, 1]; exit 2 is a parse or usage error.
• sandbox_type: copy_targets. glsec refuses a pipeline file that is a symbolic link out of its directory (a guard against reading files outside the repository), and in the default sandbox the target is such a link. Without this the test shows two task failures and no issues.
• issue_url_format points at the rule pages on https://glsec.github.io/rules/.
• suggest_if: files_present, so trunk init suggests it when a pipeline file exists.
• The test moves the input to .gitlab-ci.yml, the same way the zizmor test moves its inputs under .github/workflows.
• README: a "GitLab" row and the link. I left the Security row alone, since adding it there would widen the whole table.

Testing, run in a Node 22 container with trunk 1.25.0:

• npm test linters/glsec passes; the snapshot has GL001 (mutable image tag), GL011 (curl piped to sh) and GL024 (pipe without pipefail) and no task failures.
• npm test tests/repo_tests: 236 passed.
• trunk check --upstream upstream/main: no new issues.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here