Ini file settings ignored

Describe the bug
Adding excluded files, output format or output file in .bandit is ignored.

To Reproduce
Steps to reproduce the behavior:

1. Create .bandit with:

[bandit]
exclude: *.ipynb_checkpoints/*
recursive: true
targets: ./src
format: html
output: bandit.html

2. Run bandit --ini .bandit
3. See that it uses command line arg for exclude, output format and output file instead of the ini file.

[main]	INFO	Using command line arg for excluded paths
[main]	INFO	Using ini file for selected targets
[main]	INFO	Using ini file for recursive scan
[main]	INFO	Using command line arg for aggregate output type
[main]	INFO	Using command line arg for max code lines output for issue
[main]	INFO	Using command line arg for severity level
[main]	INFO	Using command line arg for confidence level
[main]	INFO	Using command line arg for output format
[main]	INFO	Using command line arg for output file
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.7.6

Expected behavior
I expected the format used to be the one from the .bandit ini file, instead of the default from the command line. Same goes for exclude and output.

Bandit version

bandit 1.6.3
  python version = 3.7.6 (default, Jan  8 2020, 19:59:22) [GCC 7.3.0]

Additional context
I think what's happening in the code is the following:
When checking if one should use the command line argument or the ini file, the code checks if the command line argument has a value. If not, it falls back to the ini file. However, arguments have defaults set in the parser, and thus some will always have a value set, and will always override the ini values. That's what I think is happening for exclude, format and output at least.

Solution is to check if the argument is passed, and if not, check for ini values, and if these are not set, fall back to a default.

Start by reproducing bandit --ini .bandit with the configuration shown, then inspect the argument parser and the precedence between command-line defaults and INI values. Done means explicitly supplied command-line options still win, while exclude, format, and output from the INI file are honored when those options are omitted, with regression coverage for the reported case.