Document local markdownlint and internal hyperlink

Signed-off-by: David A. Wheeler <[email protected]>

Author: david-a-wheeler

README.md

@@ -21,6 +21,8 @@ to file [issues](https://github.com/ossf/secure-sw-dev-fundamentals/issues) for
 [secure-sw-dev-fundamentals](https://github.com/ossf/secure-sw-dev-fundamentals)
 project. Changes that are accepted into the Markdown must go through a series of internal steps in coordination with LF Training & Certification so that the changes will be deployed to both the LF Training and edX platforms.
 
+Changes to the markdown must have no errors reported by `markdownlint` using our configuration. This is checked when a pull request is made. You can do this check locally by installing markdownlint (e.g., `brew install markdownlint-cli` or `npm install -g markdownlint-cli`) and running `make`.
+
 This content was originally converted from Google docs format using
 [gdocs2md](http://github.com/mangini/gdocs2md),
 patched to skip inline drawings.

secure_software_development_fundamentals.md

@@ -39,6 +39,8 @@ For more, see [5 Stupid Grammar Rules You Should Never Follow Because They Make
 
 Note that edX requires groupings at 3 levels: Sections, Subsections, and Units. Only Units (level 3) can have content.  We represent this in the material below as follows:  A “Heading 1” represents the beginning of a Section and contains ONLY sequences beginning with “Heading 2” (no text). A “Heading 2” represents the beginning of a Subsection and contains ONLY sequences beginning with “Heading 3”. A “Heading 3” represents the beginning of a Unit and contains all content. A Heading 3 cannot be directly contained within a Heading 1. Heading 4 (and below) are used freely within a Unit.
 
+The primary editable content is in markdown format. There should be no markdownlint errors using our configuration. You can add hyperlinks to internal sections as #<i>section_name</i> where <i>section_name</i> is the title transformed using GitHub's [`gfm_auto_identifiers`](https://pandoc.org/MANUAL.html#extension-gfm_auto_identifiers) algorithm: space becomes `-`, uppercase (ASCII) becomes lowercase, and punctuation (other than `-` and `_`) are removed.
+
 **About this course (Part 1)**
 
 Modern software is under constant attack, but many software developers have never been told how to effectively counter those attacks. This course works to solve that problem, by explaining the fundamentals of developing secure software. Geared towards software developers, DevOps professionals, software engineers, web application developers, and others interested in learning how to develop secure software, this course focuses on practical steps that can be taken, even with limited resources, to improve information security. This course will enable software developers to create and maintain systems that are much harder to successfully attack, reduce the damage when attacks are successful, and speed the response so that any latent vulnerabilities can be rapidly repaired.