🔒: add bandit code scanner

[schlich]

GitHub security suggests a code scanner, I think bandit is fine.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[MrCordeiro]

Looks good to me! Thanks for the PR!
I'm guessing the workflow was auto-generated, as some of the comments seem superfluous (lines 1-11). But I don't think it's deal-breaker, we can trim those later.

Feel free to rebase and merge when you can!

[schlich]

@MrCordeiro can you confirm we want a rebase here? Since master's HEAD is a direct descendant of this branch's HEAD, I think a merge commit would give us less headaches, but i'm not familiar with the nuances of GitHub's "rebase and merge" button. I usually reserve rebasing for updating feature branches if master HEAD is not a descendant of feature branch HEAD.

Let me know if I'm missing something... rebasing makes me more nervous than merging to main 😅

[MrCordeiro]

No problems, do what you feel more comfortable with. 😉

(For context: the rebase strategy is good for avoiding the extra commit that's created by the default merge strategy. Btw, since this PR consists of a single commit, a squash merge would achieve the same result.)