Switch to upstream PyCQA/bandit-action once SHA pinning is merged

## Context

We currently pin to a fork (`lhoupert/bandit-action`) instead of the upstream
`PyCQA/bandit-action` because the upstream action pins its internal dependencies
(`actions/setup-python`, `actions/checkout`, `github/codeql-action/upload-sarif`)
to mutable version tags rather than full-length commit SHAs.

This breaks workflows in environments that enforce SHA pinning for all transitive
action dependencies — a policy enforced by StepSecurity and OpenSSF Scorecard.

Upstream issue: https://github.com/PyCQA/bandit-action/issues/28
Upstream fix PR: https://github.com/PyCQA/bandit-action/pull/29 (awaiting review)

## Action required

Once PR #29 is merged and a new release of `PyCQA/bandit-action` is cut, update
`action.yml` to replace:

```yaml
uses: lhoupert/bandit-action@

with the upstream pinned SHA:

uses: PyCQA/bandit-action@ # vX.Y.Z

Then the fork can be retired.
```

先檢查 PyCQA/bandit-action 的 issue #28 和 PR #29，然後確認已發布具有以 SHA 鎖定之相依性的新版 upstream release。將 `action.yml` 中的 `uses` 參照更新為已發布的 upstream commit，保留其版本註解，並確認不再有任何 fork 參照。

由索引模型根據 Issue 內容生成。