ci: run bandit from the locked sast group instead of bandit-action

PyCQA/bandit-action v1 hardcodes Python 3.8 (v1.0.1: 3.9), which the
ubuntu-latest runner no longer provides, so the sast job failed during
setup on every run before bandit started.

Run the bandit pinned in uv.lock with the pyproject.toml configuration,
the same way tox -e sast does. Findings now fail the job; the action
ignored bandit's exit code and only uploaded SARIF results.

Author: nandgator

.github/workflows/sast.yaml

@@ -11,11 +11,20 @@ on:
 jobs:
   sast:
     permissions:
-      security-events: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - name: Bandit
-        uses: PyCQA/bandit-action@v1
+      # checkout repository
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      # set up uv and a specific python version
+      - name: Set up uv with Python v3.14
+        uses: astral-sh/setup-uv@v10.3.0
         with:
-          targets: src/validators
-          exclude: .github,.pytest_cache,.venv,.vscode,site,tests
+          python-version: "3.14"
+          enable-cache: true
+      # bandit, pinned by uv.lock and configured in pyproject.toml
+      - name: Install 'sast' dependencies
+        run: uv sync --locked --group sast
+      - name: Bandit
+        run: uv run --no-sync bandit -c pyproject.toml -r src/validators