GRM-24: chore: add bandit dependency, Makefile target and pre-commit hook

.pre-commit-config.yaml

@@ -32,6 +32,14 @@ repos:
         pass_filenames: false
         stages: [pre-commit]
 
+      - id: lint-bandit
+        name: bandit security scan
+        entry: make lint-bandit
+        language: system
+        types: [python]
+        pass_filenames: false
+        stages: [pre-commit]
+
       - id: ansible-lint
         name: ansible-lint
         entry: make ansible-lint

Makefile

@@ -83,7 +83,10 @@ lint-format:
 typecheck:
 	$(BIN)/pyright
 
-lint: lint-ruff lint-format typecheck
+lint: lint-ruff lint-format typecheck lint-bandit
+
+lint-bandit:
+	$(BIN)/bandit -r src/ scripts/
 
 ansible-lint:
 	$(BIN)/ansible-lint ansible/

pyproject.toml

@@ -32,6 +32,7 @@ dev = [
     "molecule>=26.4.0",
     "molecule-docker>=2.1.0",
     "ansible-lint>=26.4.0",
+    "bandit>=1.8.2",
     "pre-commit>=4.6.0",
     # Non-Python dev dependency: checkmake (Makefile linter)
     # Install via: go install github.com/mrtazz/checkmake/cmd/checkmake@latest