Vulnerabilities action feedback

Feedback from using the `check-vulnerabilities` action. This is a consolidation of a discussion with @RobPasMue

- [ ] It should be documented how `bandit` can be configured: inline and global skips (link to bandit docs)
- [x] Allow bandit configuration in `pyproject.toml`. Currently only a `.bandit` file in the `src` directory works.
- [ ] Local run may need a `python -m pip install -U pip setuptools` step
- [ ] For local run, it would be good to provide an easier option, e.g. as a pre-commit hook. It's ok FMPOV if that hook does not have access to existing advisories, since a token shouldn't be needed. It may be wise to put the hook into a separate hook-stage, to avoid running it in the regular `pre-commit` CI job (and thus "leak" the output).
- [ ] The approach to dealing with warnings that will not be fixed should be documented [1]: Add an in-line ignore statement, and (if there are circumstances in which the code could actually be problematic) document them in the library docs. If it's a false positive, only add the inline ignore statement.
- [ ] We should probably also align on _where_ in the documentation the "security guide" can be found. This will make it easier for ACE when combining multiple PyAnsys libraries into an app to find the relevant info.

[1] We may also want to discuss this approach in a wider audience.

Start with the check-vulnerabilities action and the existing .bandit handling under src; review the checked pyproject.toml item and determine which unchecked items remain. Cover Bandit configuration, local setup, a possible pre-commit hook, warning guidance, and the security guide location. Done means each remaining checkbox has an agreed implementation or documentation change.

Written by the indexing model from the issue text.