fix: bandit warnings

[klmcadams]

• Change pass to raise Exception
• Add # no sec lines to subprocesses where the arguments are known/valid
• Remove shell=True from subprocess

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.19%. Comparing base (4153cc3) to head (2e34633).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #950      +/-   ##
==========================================
- Coverage   85.39%   81.19%   -4.21%     
==========================================
  Files          36       36              
  Lines        2308     2302       -6     
==========================================
- Hits         1971     1869     -102     
- Misses        337      433      +96