Switch to upstream PyCQA/bandit-action once SHA pinning is merged

先检查 PyCQA/bandit-action 的 issue #28 和 PR #29，然后确认已发布带有通过 SHA 固定的依赖项的新 upstream 版本。将 action.yml 中的 uses 引用更新为已发布的 upstream commit，保留其版本注释，并验证不再有任何 fork 引用。

Context

We currently pin to a fork (lhoupert/bandit-action) instead of the upstream
PyCQA/bandit-action because the upstream action pins its internal dependencies
(actions/setup-python, actions/checkout, github/codeql-action/upload-sarif)
to mutable version tags rather than full-length commit SHAs.

This breaks workflows in environments that enforce SHA pinning for all transitive
action dependencies — a policy enforced by StepSecurity and OpenSSF Scorecard.

Upstream issue: https://github.com/PyCQA/bandit-action/issues/28
Upstream fix PR: https://github.com/PyCQA/bandit-action/pull/29 (awaiting review)

Action required

Once PR #29 is merged and a new release of PyCQA/bandit-action is cut, update
action.yml to replace:

uses: lhoupert/bandit-action@<sha>                                                                                                                                                                                                 
                        
with the upstream pinned SHA:                                                                                                                                                                                                      

uses: PyCQA/bandit-action@<new-sha>  # vX.Y.Z                                                                                                                                                                                      
                                                                                                                                                                                                                                   
Then the fork can be retired.