[EPIC] linux_new: Packaging pipeline refactor — de-duplication, build-only mode, security scanning & regression tests

The `linux_new` pipeline builds Temurin JDK/JRE packages (.deb, .rpm, .apk) across 8 active Java versions. This epic tracks four improvements to reduce maintenance overhead, improve operational flexibility, add security assurance, and protect against regressions.

## Problem Statement

| Problem | Impact |
|---|---|
| ~88 near-identical template files spread across per-version directories | Adding a new Java version requires copying ~11 files per package format and manually editing version numbers throughout |
| No way to build packages without publishing to Artifactory | Impossible to validate packaging changes or debug issues without risking the production repository |
| No security scanning of produced packages before publish | CVEs in bundled JDK binaries or native libraries are not detected before distribution |
| No tests for the template layer | Changes to shared logic can silently corrupt package metadata for one or more versions; only caught by a full package build |

---

## Constraints & Non-Goals

- All existing version-parsing logic, architecture mapping, package naming, GPG signing behaviour
and Artifactory upload paths are preserved **exactly as-is**
- No changes to Gradle build configuration or Docker images
- No changes to existing TestContainers test logic (only additive `TEST_AGAINST_PUBLISHED` mode)
- The `SKIP_UPLOAD` parameter is independent of `DRY_RUN` — both can be set independently

---

## Hard Dependency

> ⚠️ The golden file commit (first step of the regression tests issue) **must land before any
> template files are changed**. It captures the current output as the correctness baseline.
> Merging template changes before the golden files exist removes the ability to verify equivalence.

---

## Implementation Order

Capture golden files (prerequisite — part of regression tests issue, done first)
Debian shared templates
Alpine + RHEL/SUSE shared templates
SKIP_UPLOAD + Grype scanning ← independent, can run in parallel with 2–3
Complete regression test suite wiring

---

## Acceptance Criteria

- [ ] Adding a new Java version requires only a new `version.yaml` entry and a new version
directory — no template files to copy or hand-edit
- [ ] A Jenkins build with `SKIP_UPLOAD=true` produces and archives packages without touching Artifactory
- [ ] Every package build produces a Grype scan report archived as a JSON artifact
- [ ] `tests/template_regression/run_tests.sh` passes against all 8 versions × all distro families
- [ ] The regression test suite is run as a pipeline stage before `Generate Spec File`
- [ ] All existing packages continue to build and install correctly (validated by existing
TestContainers tests)