ci: run bandit from the locked sast group instead of bandit-action

.github/workflows/sast.yaml

@@ -11,11 +11,20 @@ on:
 jobs:
   sast:
     permissions:
-      security-events: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - name: Bandit
-        uses: PyCQA/bandit-action@v1
+      # checkout repository
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      # set up uv and a specific python version
+      - name: Set up uv with Python v3.14
+        uses: astral-sh/setup-uv@v10.3.0
         with:
-          targets: src/validators
-          exclude: .github,.pytest_cache,.venv,.vscode,site,tests
+          python-version: "3.14"
+          enable-cache: true
+      # bandit, pinned by uv.lock and configured in pyproject.toml
+      - name: Install 'sast' dependencies
+        run: uv sync --locked --group sast
+      - name: Bandit
+        run: uv run --no-sync bandit -c pyproject.toml -r src/validators