Turn on flake8-bandit lint rules

Almost all of them are checked now, with few exceptions that tend to
return false positives.

pyproject.toml

@@ -42,10 +42,11 @@ target-version = "py38"
 
 [tool.ruff.lint]
 select = ["ALL"]
-ignore = ["ANN", "D", "TRY", "S", "PTH", "PLR", "COM", "PT005", "ISC001", "INP001"]
+ignore = ["ANN", "D", "PTH", "PLR", "PT005", "ISC001", "INP001", "S603", "S607", "COM812"]
 
 [tool.ruff.lint.per-file-ignores]
-"tests/*" = ["INP001"]
+"src/httpie_credential_store/_keychain.py" = ["S602"]
+"tests/*" = ["S101", "INP001"]
 
 [tool.ruff.lint.isort]
 known-first-party = ["httpie_credential_store"]

tests/test_keychain_password_store.py

@@ -57,14 +57,8 @@ def gpg_key_id(monkeypatch, tmp_path):
         encoding="UTF-8",
     )
 
-    subprocess.check_output(
-        f"gpg --batch --generate-key {gpgtemplate}",
-        shell=True,
-        stderr=subprocess.STDOUT,
-    )
-    keys = subprocess.check_output(
-        "gpg --list-secret-keys", shell=True, stderr=subprocess.STDOUT
-    ).decode("UTF-8")
+    subprocess.check_call(["gpg", "--batch", "--generate-key", gpgtemplate])
+    keys = subprocess.check_output(["gpg", "--list-secret-keys"], text=True)
 
     key = re.search(r"\s+([0-9A-F]{40})\s+", keys)
     if not key:
@@ -97,7 +91,7 @@ def testkeychain():
 def test_secret_retrieved(testkeychain, gpg_key_id):
     """The keychain returns stored secret, no bullshit."""
 
-    subprocess.run(["pass", "init", gpg_key_id], check=True)
+    subprocess.check_call(["pass", "init", gpg_key_id])
     subprocess.run(["pass", "insert", "--echo", "service/user"], input=b"f00b@r", check=True)
 
     assert testkeychain.get(name="service/user") == "f00b@r"