Custom flavor generator output does not pass MegaLinter's own linters

[laywill]

Describe the bug

The files generated by npx mega-linter-runner --custom-flavor-setup don't
pass MegaLinter when the newly created flavor repository lints itself with the
standard mega-linter.yml workflow. Since the generated repo is a MegaLinter
repo, the first CI run after following the Custom Flavors guide fails.

I hit this setting up a flavor for my own repos and fixed it locally. Happy to
open a PR against the generator templates if that's useful — I didn't want to
send one unprompted in case the strictness here is deliberate.

Findings, all from generators/mega-linter-custom-flavor/templates/:

check-new-megalinter-version.yml and megalinter-custom-flavor-builder.yml

• ACTION_ACTIONLINT (ShellCheck SC2086) — 16 findings from unquoted
  redirect targets, e.g. echo "tag=$TAG" >> $GITHUB_OUTPUT. Fixed by
  quoting: >> "$GITHUB_OUTPUT".
• ACTION_ACTIONLINT (ShellCheck SC2129) — the Summary step's consecutive
  >> $GITHUB_STEP_SUMMARY writes. Fixed by grouping them into one
  { … } >> "$GITHUB_STEP_SUMMARY".
• ACTION_ZIZMOR (unpinned-uses, error) — actions/checkout@v6 and
  docker/login-action@v3 aren't hash-pinned.
  oxsecurity/megalinter/flavors/custom-builder@main is flagged too, but I
  assume that one is deliberate, since the builder needs to track upstream; I
  allowed it via an unpinned-uses policy in .github/zizmor.yml rather than
  pinning it. A line in the guide mentioning that exception would have saved
  me some guessing.
• ACTION_ZIZMOR (artipacked) — the builder's checkout step doesn't set
  persist-credentials: false.
• EDITORCONFIG_EDITORCONFIG_CHECKER — trailing whitespace on 6 lines of
  check-new-megalinter-version.yml, plus a 13-space continuation indent at
  lines 200-202 where .editorconfig asks for a multiple of 2.
• REPOSITORY_CHECKOV (CKV_GHA_7) — "workflow_dispatch inputs MUST be
  empty". This one looks unavoidable, since check-new-megalinter-version.yml
  dispatches the builder with --field megalinter-version /
  --field is-latest. Might be worth a note in the docs that flavor repos
  need to skip it.

README.md

• MARKDOWN_MARKDOWNLINT (MD024) — the "How to use the custom flavor"
  section appears twice, once near the top and once at the bottom.
• MARKDOWN_MARKDOWNLINT (MD034) — the repo URL on the "It is built from
  official MegaLinter images…" line is a bare URL.

Three unrelated template bugs I noticed while fixing the above

1. check-new-megalinter-version.yml — the PAT setup instructions say "Choose
   this repository (megalinter-custom-flavor-npm-groovy-lint)". Looks like a
   leftover from the repo the template was written against; it appears
   verbatim in every generated flavor.
2. check-new-megalinter-version.yml — the Summary step sets
   GH_REPO: ${GITHUB_REPOSITORY} in its env: block. That isn't an Actions
   expression, so it's passed through as the literal string
   ${GITHUB_REPOSITORY}. The variable is unused in that step, so nothing
   breaks today.
3. megalinter-custom-flavor-builder.yml — the header comment says the image
   lands at ghcr.io/<owner>/<repo>:<tag>, but the actual path is
   ghcr.io/<owner>/<repo>/megalinter-custom-flavor:<tag>.

To Reproduce

1. Create a repository whose name contains megalinter-custom-flavor,
   containing a normal .github/workflows/mega-linter.yml that lints the repo
   with the official action.
2. Run npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,MARKDOWN_MARKDOWNLINT,YAML_YAMLLINT
   (any linter set works — the failures are in the generated files, not the
   flavor).
3. Commit and push.
4. The repository's own MegaLinter run fails on actionlint, zizmor,
   editorconfig-checker, markdownlint and checkov.

Expected behavior

The generated scaffolding passes MegaLinter out of the box, so a new custom
flavor repo starts green.

Additional context

• mega-linter-runner@9.6.0, generator mega-linter-custom-flavor
• Verified with actionlint (Docker rhysd/actionlint:latest), zizmor
  v1.29.0, editorconfig-checker (Docker
  mstruebing/editorconfig-checker:latest), and MegaLinter v9.6.0 in GitHub
  Actions
• The repo where I hit this, with the fixes applied:
  https://github.com/laywill/megalinter-custom-flavor-github-latex-markdown

Thanks for MegaLinter, and for the custom flavors feature in particular — the
image size saving is exactly what I needed.

[laywill]

Duplicates my previous incorrectly formatted and labelled #8678

[nvuillam]

@laywill thanks for the findings :)

I'll accept gladly your PR :)