ci: block on mypy and bandit and run hooks from the lock

Pre-commit runs ruff, isort and bandit through uv run, so it uses the versions in uv.lock. Bandit moves from runtime dependencies to the dev group.

pyproject.toml

@@ -65,7 +65,6 @@ dependencies = [
     "language-data>=1.4.0",
     "wasmtime>=41.0.0",
     "rnet>=2.4.2",
-    "bandit>=1.9.4",
     "jsonpath-ng>=1.8.0",
     "mutagen>=1.47.0,<2",
     "defusedxml>=0.7.1",
@@ -95,6 +94,7 @@ dev = [
     "isort>=5.13.2,<8",
     "ruff>=0.15.12,<0.16",
     "types-pyyaml>=6.0,<7",
+    "bandit>=1.9.4,<2",
 ]
 test = [
     "pytest>=8.3.0,<9",