Switch to upstream PyCQA/bandit-action once SHA pinning is merged

## Context

We currently pin to a fork (`lhoupert/bandit-action`) instead of the upstream
`PyCQA/bandit-action` because the upstream action pins its internal dependencies
(`actions/setup-python`, `actions/checkout`, `github/codeql-action/upload-sarif`)
to mutable version tags rather than full-length commit SHAs.

This breaks workflows in environments that enforce SHA pinning for all transitive
action dependencies — a policy enforced by StepSecurity and OpenSSF Scorecard.

Upstream issue: https://github.com/PyCQA/bandit-action/issues/28
Upstream fix PR: https://github.com/PyCQA/bandit-action/pull/29 (awaiting review)

## Action required

Once PR #29 is merged and a new release of `PyCQA/bandit-action` is cut, update
`action.yml` to replace:

```yaml
uses: lhoupert/bandit-action@

with the upstream pinned SHA:

uses: PyCQA/bandit-action@ # vX.Y.Z

Then the fork can be retired.
```