Rework to use the debian docker based runner

.gitea/workflows/bandit.yml

@@ -1,17 +1,36 @@
 ---
 name: Bandit
-on: [push]
-
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
 
 # XXX need to do stuff with uv
 jobs:
-  build:
-    runs-on: freebsd
+  audit-runtime-security:
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.11"]
+        python-version:
+          - "3.11"
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '${{ matrix.python-version }}'
+          cache: 'pip'
+          cache-dependency-path: 'requirements.txt'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --upgrade bandit
+          pip install -r requirements.txt
+
       - name: Analyse code with Bandit
         run: |
           bandit -r .