False negative: B103 fails to detect dangerous permissions set via stat module constants

Describe the bug

Rule B103 currently only evaluates the mode argument in chmod if it is an integer literal. It fails to detect dangerous file permissions when developers use standard stat module constants (e.g., stat.S_IWOTH | stat.S_IWGRP). These are parsed as AST BinOp or Attribute nodes rather than Int nodes, causing the rule to bypass them completely.

Reproduction steps

Run Bandit on the following snippet:

import os
import stat
# False Negative
os.chmod('config.ini', stat.S_IWGRP | stat.S_IWOTH)

Expected behavior

Bandit should resolve or explicitly check for dangerous stat constants (like S_IWOTH, S_IWGRP, S_IXOTH, S_IXGRP) in Attribute and BinOp nodes, raising warnings just as it does for integer literals like 0o777.

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response

Start at the B103 rule implementation and run the provided Python chmod reproduction with stat.S_IWGRP | stat.S_IWOTH. Trace how mode arguments are handled for integer literals, Attribute nodes, and BinOp nodes. Done means dangerous stat constants such as S_IWOTH, S_IWGRP, S_IXOTH, and S_IXGRP produce warnings like equivalent integer literals.