linux_new: Add SKIP_UPLOAD parameter and Grype security scanning stage

Part of #1445

--

## Background

### Missing build-only mode

The pipeline currently has no way to build and archive packages without also publishing them
to Artifactory. The existing `DRY_RUN` flag skips the entire pipeline including the build
itself, so there is no intermediate mode. This makes it impossible to:

- Validate packaging changes for a new version before committing to a release
- Debug build or template issues without risking the production Artifactory repository
- Run the pipeline in a test environment without Artifactory credentials

### No security scanning

Packages produced by this pipeline contain bundled JDK binaries and native libraries. These
are not currently scanned for known CVEs before being published. IBM security policy requires
critical severity findings (CVSS ≥ 9.0) to be addressed within 24 hours and high severity
(CVSS ≥ 7.0) within 30 days. Without scanning, violations of these thresholds would go
undetected until an external audit.

---

## Goal

1. Add a `SKIP_UPLOAD` boolean parameter that allows the full build to run (validate artifacts,
generate specs, build packages, archive) without executing the `Publish Packages` stage.
2. Add a `Scan Packages` stage using **Grype** (Anchore, Apache 2.0 licensed, actively
maintained) that scans all built `.deb`, `.rpm`, and `.apk` files for CVEs before they
are published, with configurable failure threshold and JSON results archived as build
artifacts.

These two features are independent of the template de-duplication work (child issues #1 and
#2) and can be implemented and merged in parallel.

---

## Scope

### Part A — `SKIP_UPLOAD` parameter

**New parameter** added to the `parameters {}` block:
```groovy
booleanParam(
name: 'SKIP_UPLOAD',
defaultValue: false,
description: 'Build and archive packages but do not publish to Artifactory'
)