fix(validation): replace gherkin-lint with GPLint

[hdamker]

What type of PR is this?

cleanup

What this PR does / why we need it:

This PR replaces the validation framework Gherkin linter dependency from gherkin-lint to GPLint.

gherkin-lint pulls in stale Cucumber packages and the vulnerable uuid dependency chain behind Dependabot alert #17. GPLint is a maintained fork with current Cucumber packages, while preserving the same rule model closely enough for a narrow migration.

The change keeps CAMARA Validation v1 behavior stable while leaving legacy v0 validation untouched:

• preserves the validation engine identity as gherkin
• preserves the existing G-001 through G-025 rule metadata mapping
• adds a dedicated GPLint config at linting/config/.gplintrc
• keeps linting/config/.gherkin-lintrc compatible with the v0 MegaLinter / gherkin-lint workflow and marks it deprecated
• removes the unsupported disabled only-one-when entry from the GPLint config only
• migrates required-tags.tags to GPLint's required-tags.scenario regex-array shape in .gplintrc
• updates validation v1 to invoke gplint and parse JSON findings from exit code 0 or 1

Which issue(s) this PR fixes:

Fixes #138

Special notes for reviewers:

The full validation/ audit is still non-zero after this PR because of unrelated Redocly/OpenTelemetry/Redoc/protobufjs advisories. This PR is expected to clear the uuid alert path only.

Local verification for the final config split:

• python3 -m pytest validation/tests/test_gherkin_adapter.py validation/tests/test_rule_metadata_integrity.py validation/tests/test_orchestrator.py
• python3 -m pytest validation/tests tooling_lib/tests
• live gplint --format json --config linting/config/.gplintrc ... smoke test
• git diff --check
• npm ci --ignore-scripts in validation/ as the package manifest/lockfile sync gate
• optional dependency-tree follow-up: npm ls gplint gherkin-lint uuid

Changelog input

 release-note
Replace the validation v1 Gherkin feature-file linter dependency from `gherkin-lint` to GPLint while preserving existing Gherkin validation rule IDs and finding normalization. The legacy v0 `.gherkin-lintrc` remains for the deprecated MegaLinter workflow; GPLint uses `linting/config/.gplintrc`.

Additional documentation

This section can be blank.

docs

[hdamker]

Changed back to draft to decouple the new configuration from the validation v0 configuration (Megalinter is still using gherkin-lint and the configuration file).

[hdamker]

Done: I split the Gherkin linter configs so validation v1 uses GPLint's standard linting/config/.gplintrc, while the legacy v0 MegaLinter workflow keeps linting/config/.gherkin-lintrc in the old gherkin-lint schema. Back to review.

[rartych]

LGTM

[hdamker]

Note: CI failed because npm resolver drift around GPLint’s optional ts-node dependency left the required typescript peer out of validation/package-lock.json; the branch now regenerates the lock with CI’s npm and adds validation-local engine/Node guardrails so stale local npm versions fail before producing divergent locks.