Add CI security scanners

[codeforester]

Summary

• add Bandit as a pinned development dependency
• add a CI security scanner job for Bandit and ShellCheck
• run Bandit at medium-or-higher severity to avoid blocking on existing low-risk subprocess noise

Fixes #130

Tests

• PYTHONPATH=/private/tmp/base-bandit /Users/rameshhp/.base.d/base/.venv/bin/python -m bandit -q -r cli/python lib/python -x '*/tests/*' --severity-level medium
• ~/.base.d/base/.venv/bin/python -m pip install --dry-run -r requirements-dev.txt
• git diff --check

Note: ShellCheck is installed by the CI job through apt; it is not installed locally on this machine.