Move bandit to pre-commit

Ensure committing locally will raise bandit check errors before we push
the change by putting it into the pre-commit. Since pre-commit is
already invoked in the pep8 env we can drop bandit from there.

Change-Id: I4d9d5aa283fb6cb91d610e23c6a44e98d8df46aa

.pre-commit-config.yaml

@@ -32,6 +32,11 @@ repos:
     hooks:
       - id: black
         args: ['-S', '-l', '79']
+  - repo: https://github.com/PyCQA/bandit
+    rev: '1.7.9'
+    hooks:
+    - id: bandit
+      args: ["-x", "keystone/tests/*,devstack/*"]
   # - repo: https://opendev.org/openstack/hacking
   #   rev: 6.1.0
   #   hooks:

tox.ini

@@ -29,8 +29,6 @@ commands =
   # Run bash8 during pep8 runs to ensure violations are caught by
   # the check and gate queues
   bashate devstack/plugin.sh
-  # Run security linter
-  bandit -r keystone -x 'keystone/tests/*'
 
 [testenv:fast8]
 envdir = {toxworkdir}/pep8