Docker - Pin pip install versioning in the bandit/Dockerfile, as per best practices.

**Describe the bug**
Best practices from hadolint tell us we should pin versions of installs made through pip.

**To Reproduce**
Steps to reproduce the behavior:
1. Remove the `ignore directive` from above the `pip install bandit` in the the `bandit/Dockerfile`.
2. Run a build.
3. See it fail and complain about pinning pip version.
4. Something like this:

```
$ docker run --rm -i hadolint/hadolint < bandit/Dockerfile
Unable to find image 'hadolint/hadolint:latest' locally
latest: Pulling from hadolint/hadolint
Status: Downloaded newer image for hadolint/hadolint:latest
/dev/stdin:3 DL3013 Pin versions in pip. Instead of `pip install ` use `pip install ==`
```

**Expected behavior**

The `ignore directive` can be removed and the pip install occurs in a best practices fashion.

**Additional context**

However, I'm not entirely sure what is involved in getting this to work in an automated way, so that versions can be bumped simply with little to no manual (human) intervention. It would be interesting to see this completed so that the Hadolint ignore directive can be removed from [the bandit Dockerfile](https://github.com/opensorcery-io/docker-services/blob/master/bandit/Dockerfile) and we can comply with best practices.