Baseline matching ignores line number and uses set membership, not count

Describe the bug

Issue.eq (bandit/core/issue.py) compares text, severity, cwe, confidence, fname, test, test_id -- not lineno. And _compare_baseline_results (bandit/core/manager.py) filters with "a not in baseline", i.e. set membership, not multiplicity. So one baseline entry with a given signature can absorb any number of new findings with the same signature in the same file, not just a same-count swap -- an unlimited one.

Reproduction steps

1. app.py has 1 B105 violation (hardcoded password) at line 2. Run: bandit -f json -o baseline.json app.py -> baseline stores 1 issue.
2. Fix the original violation for real (remove the hardcoded password from that function).
3. Introduce 2 new B105 violations with the same literal text in two different functions (lines 6 and 10).
4. Run: bandit -f json app.py (no baseline) -> 2 results.
5. Run: bandit -b baseline.json app.py -> "No issues identified.", exit 0.

Expected behavior

The baseline should only suppress the specific violation it recorded. Since only one violation was in the original baseline, at least the two new violations (different lines, same rule) should surface -- not be silently absorbed because the total count happens to be small.

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

Suggest: include lineno (or a stable per-occurrence identity) in Issue.eq, or at minimum count occurrences per signature and only filter matching count instead of set membership (currently a not in baseline).

Reproduced locally on bandit 1.9.4 (pip install bandit) -- the version dropdown above only lists up to 1.9.1, closest available option kept as default.

Background, optional: https://doi.org/10.5281/zenodo.21908527

Start by reading Issue.eq in bandit/core/issue.py and _compare_baseline_results in bandit/core/manager.py, then reproduce the baseline scenario from the issue. Add focused coverage for repeated findings and verify that baseline filtering respects occurrence counts or distinct line identities, while existing baseline suppression continues to work.