Switch to upstream PyCQA/bandit-action once SHA pinning is merged

Controlla prima l’issue #28 e la PR #29 di PyCQA/bandit-action, quindi conferma che sia stata pubblicata una nuova release upstream con dipendenze fissate tramite SHA. Aggiorna il riferimento uses in action.yml al commit upstream rilasciato, mantieni il relativo commento sulla versione e verifica che non rimanga alcun riferimento a un fork.

Context

We currently pin to a fork (lhoupert/bandit-action) instead of the upstream
PyCQA/bandit-action because the upstream action pins its internal dependencies
(actions/setup-python, actions/checkout, github/codeql-action/upload-sarif)
to mutable version tags rather than full-length commit SHAs.

This breaks workflows in environments that enforce SHA pinning for all transitive
action dependencies — a policy enforced by StepSecurity and OpenSSF Scorecard.

Upstream issue: https://github.com/PyCQA/bandit-action/issues/28
Upstream fix PR: https://github.com/PyCQA/bandit-action/pull/29 (awaiting review)

Action required

Once PR #29 is merged and a new release of PyCQA/bandit-action is cut, update
action.yml to replace:

uses: lhoupert/bandit-action@<sha>                                                                                                                                                                                                 
                        
with the upstream pinned SHA:                                                                                                                                                                                                      

uses: PyCQA/bandit-action@<new-sha>  # vX.Y.Z                                                                                                                                                                                      
                                                                                                                                                                                                                                   
Then the fork can be retired.