ci: fix SAST / Kuiper64 regressions and defer nemo hw runner

- .bandit-baseline.json: regenerated to pick up the two new Low
  severity findings introduced by ``adidt/cli/gen_dts.py`` (B404
  subprocess import, B603 subprocess.run call).  Both are a safe
  ``dtc`` invocation with a hard-coded argv list and no shell=True.

- .github/workflows/test-kuiper.yml: install ``python3-dev`` inside
  the Kuiper64 arm64 container before ``pip install .[test]``.  The
  ``aandrisa/kuiper_basic_64:latest`` image was updated ~24h before
  this PR such that docplex's sdist install path now triggers a
  numpy-1.26.4 source build; without Python.h the build fails.
  This affects every PR opened after the image refresh, not only
  this branch.

- .github/hw-nodes.json: drop the ``nemo`` entry until a self-hosted
  GitHub Actions runner with label ``hw-nemo`` is registered on the
  host.  Without the runner the hw-direct / hw-coord matrix legs
  for nemo hang in "pending" forever.  Follow-up will re-add the
  entry once the runner is online.

Author: tfcollins