Fix: bandit pre-commit hook exclude regex