Linter: Add --format junit for CI test reports

[pinzonjulian]

Builds on #OUTPUT_FILE_PR, which adds --output-file. Its commit is included here, so only the last commit is new in this pull request.

This pull request adds a junit output format to herb-lint, so CI systems can show offenses as failing tests.

JUnit XML is what most CI systems read test results from: GitLab (artifacts:reports:junit), Jenkins, CircleCI (store_test_results), Azure Pipelines (PublishTestResults), Buildkite Test Engine and Buildkite's junit-annotate plugin. GitHub Actions has no native JUnit support, which --github already covers. On the other systems, a lint failure today is a red step and a log to scroll through, rather than a list of failures the CI tooling can display, group and track.

It is also a gap for teams moving from erb_lint, which has had --format junit since 0.5.0. RuboCop (since 0.80), Brakeman, Biome, Oxlint, Ruff, Pylint and golangci-lint all ship JUnit output, and ESLint moved it to eslint-formatter-junit in v9.

With --output-file, the job log keeps the readable output while the report goes to the CI system:

herb-lint --format detailed --format junit -o herb-lint.xml

<?xml version="1.0" encoding="UTF-8"?>
<testsuites name="herb-lint" tests="2" failures="1" errors="0" time="0.312">
  <testsuite name="app/views/home.html.erb" tests="2" failures="1" errors="0" skipped="0" time="0">
    <testcase classname="app/views/home.html.erb" name="html-img-require-alt" file="app/views/home.html.erb" line="3" time="0">
      <system-out>app/views/home.html.erb:3:3: warning: Missing required `alt` attribute on `&lt;img&gt;` tag. ...</system-out>
    </testcase>
    <testcase classname="app/views/home.html.erb" name="html-tag-name-lowercase" file="app/views/home.html.erb" line="2" time="0">
      <failure message="Opening tag name `&lt;SPAN&gt;` should be lowercase. Use `&lt;span&gt;` instead. (and 1 more)" type="error">app/views/home.html.erb:2:3: error: Opening tag name `&lt;SPAN&gt;` should be lowercase. Use `&lt;span&gt;` instead.
app/views/home.html.erb:2:22: error: Closing tag name `&lt;/SPAN&gt;` should be lowercase. Use `&lt;/span&gt;` instead.

https://herb-tools.dev/linter/rules/html-tag-name-lowercase</failure>
    </testcase>
  </testsuite>
</testsuites>

Each linted file becomes a <testsuite>, and each rule with offenses in that file becomes a <testcase> with the file as its classname and the rule as its name. Grouping by rule rather than by offense keeps a test's identity stable when lines move, which matters to tools that follow a test across builds. A file without offenses gets one passing testcase. The trade-off is that fixing a rule's last offense removes its testcase instead of turning it green.

A testcase fails when one of its offenses meets --fail-level. Offenses below it are listed in the <system-out> of a passing testcase. Offenses that fail the run are included even when --log-level hides them, so the report fails exactly when herb-lint exits with an error.

A run that stops before linting, such as an invalid configuration, a pattern without matching files or an unknown rule passed to --only, produces one erroring testcase with the message. A run with nothing to lint, such as a disabled linter, produces one skipped testcase, because Jenkins rejects reports without testcases by default.

Anything else printed to stdout would break the XML, so a few changes also apply to --json:

• The --force notices and stimulus-lint's project analysis messages now go to stderr.
• GITHUB_ACTIONS=true used to make --json fail on every GitHub Actions runner unless --no-github was passed. Now only an explicit --github is rejected, and annotations detected from the environment are skipped when JSON or JUnit is printed to stdout.

The GitLab CI docs gain a test report example.