Vulnerabilities And Secrets Do Not Raise Alerts

The BlueAPI repository has Dependabot, code scanning (via CodeQL) and secret scanning enabled to alert to vulnerabilities.

However, when a [branch](https://github.com/DiamondLightSource/blueapi/tree/critical-vulnerabilities) and associated [PR](https://github.com/DiamondLightSource/blueapi/pull/1119) containing a number of such vulnerabilities is created, no alerts are generated.

The vulnerabilities introduced by this PR include:
1. A plaintext `API_KEY` global variable
2. Plaintext `username` and `password` global variables
3. A `run_command` CLI command which executes un-sanitised input
4. A `download` CLI command which `wget`s un-sanitised input, using code taken from a [known CodeQL query](https://codeql.github.com/codeql-query-help/python/py-shell-command-constructed-from-input/).

## Acceptance Criteria
- When code containing "obvious" secrets is pushed to the repo, a secret scanning alert is generated
- The current CodeQL configuration is checked for best practices
- (Optional) When a vulnerability known by CodeQL is pushed to the repo, a code scanning alert is generated