[CI] Add Python bandit security linter as a pre-commit hook

Bandit is a tool designed to find common security issues in Python code.

Setup `pyproject.toml` with one global bandit ignore.  There were 2 instances of B101 in the code base and we can use inline ignores if needed.

https://bandit.readthedocs.io/en/latest/config.html

https://github.com/pycqa/bandit

https://bandit.readthedocs.io/en/latest/start.html#version-control-integration

Author: jbampton

.pre-commit-config.yaml

@@ -106,3 +106,11 @@ repos:
       - id: gitleaks
         name: run gitleaks
         description: check for secrets with gitleaks
+  - repo: https://github.com/PyCQA/bandit
+    rev: 92ae8b82fb422a639f0ed8d99e96cea769594e08 # frozen: 1.9.4
+    hooks:
+      - id: bandit
+        name: run bandit
+        description: check Python code for security issues
+        args: ['-c=pyproject.toml']
+        additional_dependencies: ['bandit[toml]']

pyproject.toml

@@ -0,0 +1,2 @@
+[tool.bandit]
+skips = ["B101"] # https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html#b101-assert-used