[SDL] Enable Bandit B404 test

[jszczepa]

Changes

This modification helps to apply SDL policy related to Bandit scans (see: https://github.com/intel-innersource/applications.security.bandit-config/blob/main/ipas_default.config)

Reason for changes

Each use of subprocess module need to be reviewed against cmd injection by potential attacker.

Related tickets

N/A

Tests

N/A

[Copilot]

Pull request overview

Enables Bandit’s B404 (“import subprocess”) check per SDL guidance, while suppressing B404 findings on specific subprocess imports.

Changes:

• Stop skipping Bandit B404 in pyproject.toml.
• Add inline # nosec B404 suppressions on subprocess imports in two Python modules.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/nncf/torch/quantization/extensions.py	Suppresses Bandit B404 on subprocess import to keep scan green while B404 is enabled.
src/custom_version.py	Suppresses Bandit B404 on subprocess import to keep scan green while B404 is enabled.
pyproject.toml	Enables B404 by removing it from Bandit’s skip list (commented out).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.