Add Bandit security scanning to CI/CD pipeline

[Dianababaei]

Summary

Integrate Bandit security scanning into the CI/CD pipeline and pre-commit hooks to detect common security issues in the codebase automatically.

Changes

• Add GitHub Actions workflow job for Bandit security scanning with artifact reporting
• Configure Bandit in pre-commit hooks for local security checks
• Add Bandit configuration to pyproject.toml with appropriate exclusions and skips
• Add Bandit to dev dependencies

Testing

• Verify Bandit workflow runs successfully in GitHub Actions
• Confirm pre-commit hook executes Bandit on staged Python files
• Check that security report artifact is generated and retained for 30 days

Notes

Bandit is configured to skip B404 (subprocess import) and B603 (subprocess without shell) as these are used legitimately in the codebase with safe parameters. Test and documentation directories are excluded from scanning.