No detection when passing keyword args to subprocess/shell functions

Multiple plugins in bandit/plugins/injection_shell.py assume that a command will be passed in as a positional argument. When keyword arguments are used, the plugins don't even report that a call occurred.

The only issue that Bandit reports against the below Python 2 code is the import of "subprocess":

import commands
commands.getoutput(cmd='ls')

import os
os.popen2(mode='r', cmd='ls')

import subprocess
subprocess.Popen(args='ls', shell=True)

I think a solution for the shell injection plugins is to check for either args[0] or kwargs['cmd']/kwargs['args']/etc., depending on the function.

Note: this quirk only applies to Python-defined functions. Built-in functions, like os.system() on Python 2, won't accept keyword arguments.

Start in bandit/plugins/injection_shell.py and inspect how the shell-injection plugins read positional arguments. Reproduce the keyword-argument examples from the issue, then update detection so the listed calls are reported; done means equivalent positional and supported keyword forms are detected.