Add bandit to pre-commit checks, improve version handling to avoid subprocess

[bhazelton]

Bandit catches security issues in python, so is a useful check to be doing.

When I added it, it flagged the version handling so I made some improvements to how the version is set.

Types of Changes

• Bug Fixes
• New Feature(s)
• Breaking Changes
• Documentation
• Version Change
• Translation from FHD
• Build or CI Change

Checklist

General PR Checklist

• I have the read the contribution guide
• Add all the above to the Changelog into the unreleased section

Build/CI

• Added a badge for any new CI actions or setups
• Existing badges remain unaffected, if not, document why in changelog

[codecov]

Codecov Report

❌ Patch coverage is 46.87500% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.81%. Comparing base (2e47e04) to head (1f3769d).

Files with missing lines	Patch %	Lines
src/pyfhd/pyfhd_tools/pyfhd_setup.py	46.66%	9 Missing and 7 partials ⚠️
src/pyfhd/pyfhd_tools/pyfhd_utils.py	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #103      +/-   ##
==========================================
+ Coverage   39.73%   39.81%   +0.07%     
==========================================
  Files          30       30              
  Lines        5723     5722       -1     
  Branches     1062     1060       -2     
==========================================
+ Hits         2274     2278       +4     
+ Misses       3140     3135       -5     
  Partials      309      309              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.