Honor ruff # noqa: S### suppressions in the Bandit adapter

[willfrey]

Problem

Ruff's flake8-bandit rules (S###) are a common way to run Bandit's checks as part of a single ruff pass. Those codes map one-to-one onto Bandit's tests — the numeric part is identical (S608 ⇄ B608, S310 ⇄ B310).

When a project uses ruff's S rules as its security linter and suppresses a reviewed site with # noqa: S608, the bundled Bandit run in this adapter still re-reports it. The adapter only benefits from Bandit's own # nosec, which Bandit strips before results reach us — it has no knowledge of ruff's # noqa. The result: every reviewed-and-suppressed site is reported twice (silenced by ruff, surfaced here), producing a wall of security false positives on any ruff-based project.

Minimal repro: a file containing

q = f"SELECT * FROM {table}"  # noqa: S608

is reported as a B608 finding even though the project has explicitly accepted it via ruff.

Fix

Honor ruff's # noqa the same way Bandit honors # nosec: when a Bandit finding's flagged line carries a bare # noqa, or a # noqa: S<NNN> whose number matches the Bandit test (B<NNN>), skip it. Bandit strips its own # nosec lines before results reach the adapter, so only the ruff form needs handling here.

The check reads the flagged line from the source file and matches a small noqa regex; it is scoped to B<NNN>-shaped test IDs and fails safe (reports the finding) on any read error.

Tests

• # noqa: S608 suppresses a B608 finding; a bare # noqa suppresses it; # noqa: E501 (unrelated) does not; an un-annotated line is still reported.
• Full Python-language suite and security-detector suites pass.