Latest g-r version of bandit does not require a bandit.yaml. This
removes the bandit.yaml and skips the same tests that were not
run as defined by the profile before. This patch also puts running
of bandit within the pep8 testenv, consistent with other projects.
Change-Id: I7db8bc460e2051c635dc7b3fd4b152ece80c7a0c
Add a tox environment for bandit so it can be run as a gate job
eventually. As-is, there are no high severity issues detected in heat.
Change-Id: Iab098a1d8bac5c95d67e6867ad5249987c3a786e