feat: run plugin-validator as part of CI (opt-in)

[xnyo]

Part of #354.

Example runs can be found in the smoke tests for this PR, which have been updated to run the validator.

For example: https://github.com/grafana/plugin-ci-workflows/actions/runs/19139877974/job/54701694400?pr=366

(see the annotations at the top)

[academo]

this can silently fail, because if the user defined a value here but the file doesn't exits we are now going to use the default,

maybe if the user defines a path (not empty var) and it doesn't exist (-f) we fail?

[xnyo]

Good point. I have changed the inputs so they are considered in the following order:

1. Raw yaml config content (if set) has the highest priority
2. Then, config file path (if set) is checked. If the file doesn't exist, it now errors out rather than falling back to the hardcoded config. If it's a directory, it errors out as well
3. If neither of the above is provided, the default hardcoded config is used instead

[academo]

if we are not going to run clamav we might benefit from using npx directly which can be faster than pulling and running the whole docker image? just see if that might speed up things

[xnyo]

What about semgrep, osv-scanner and gosec? The readme specifies they should be installed:

https://github.com/grafana/plugin-validator?tab=readme-ov-file#security-tools

I am not sure about osv-scanner because it looks like it's being used as a library and it should work even if it's not installed on the system.

semgrep requires the executable: https://github.com/grafana/plugin-validator/blob/e985ef06cef56f260ed0af03fa08b94f495e952a/pkg/analysis/passes/coderules/coderules.go#L95

gosec too: https://github.com/grafana/plugin-validator/blob/e985ef06cef56f260ed0af03fa08b94f495e952a/pkg/analysis/passes/gosec/gosec.go#L43

[academo]

you are correct. semgrep and gosect require system install. osv-scanner uses the go library so works via npx