Cannot pass a baseline file to pre-commit hook (baseline does not apply when filename is given as target)

Describe the bug

After creating bandit config and a baseline such that bandit -c .bandit.yaml -b .bandit_baseline.json -r . passes, I added my desired pre-commit configuration:

- repo: https://github.com/PyCQA/bandit
  rev: 1.6.2
  hooks:
    - id: bandit
      args: ["-c", ".bandit.yaml", "-b", ".bandit_baseline.json"]
      exclude: tests/.*$

and ran pre-commit run --all-files --show-diff-on-failure expecting it to pass.
However, it appears that the baseline does not apply when a file is passed to bandit (pre-commit works by passing staged files as arguments), so this fails.

To Reproduce
In an empty directory, create fail.py:

import subprocess
subprocess.run('echo hi', shell=True)

and run bandit to create a baseline:

bandit -f json -o .baseline.json -r .

Then try running bandit with that input baseline giving fail.py as an argument:

 bandit -b .baseline.json fail.py

this fails (unexpectedly!).

If you then create a baseline from fail.py, you'll get a file that works:

bandit -f json -o .baseline.json fail.py
bandit -b .baseline.json fail.py  # works!

The difference? ./fail.py vs fail.py:

61c61
<       "filename": "./fail.py",
---
>       "filename": "fail.py",

Expected behavior

With a baseline generated recursively over a repo, the pre-commit hook should pass.

In order for this to happen, running bandit to lint an explicit file with a baseline generated by a recursive walk needs to work.

Reproduce the mismatch with fail.py, .baseline.json, and the pre-commit hook configuration using bandit -b .baseline.json fail.py. Trace how filenames from a recursive baseline are compared with explicit targets. Done means a recursively generated baseline is accepted for explicit filenames and the pre-commit invocation passes.