Add bandit for security static analysis testing

Add bandit for security static analysis testing

This change adds a basic bandit config for Cinder. It can be invoked
by running the tox environment for bandit;
    tox -e bandit

This is intended as a starting point for using bandit with Cinder
and it should be revisited to improve the testing as more is learned
about the specific needs of the Cinder code base.

Tox is configured to only show results for high and medium severity
results.

https://wiki.openstack.org/wiki/Security/Projects/Bandit

Change-Id: I0247e0ccaed6faacacb2b8d2f8b141a8edc704af