Add Forge Bandit source scan

[im-sham]

Summary

• add Bandit to the Forge dependency-security CI job
• gate medium-or-higher source findings for forge_cli
• annotate the documented legacy private-network SSE bind so the new scan stays signal-heavy

Verification

• RED: /Users/shamimrehman/Projects/USMI/forge/.venv/bin/python -m pytest tests/test_ci_workflow.py failed before CI Bandit wiring
• .venv/bin/python -m pytest tests/ -v
• .venv/bin/python -m ruff check forge_cli/ tests/
• .venv/bin/python -m pip_audit --progress-spinner off
• .venv/bin/python -m bandit -r forge_cli -q --severity-level medium
• git diff --check