Follow-up on CI & lint stuff

[akx]

The promised follow-up to #56 (one of them, anyway).

This enables some of the rule categories discussed in #56 (comment).

E.g. selecting S (bandit, i.e. security) flags practically all uses of subprocess.run, which there are many, so that's elided from here.

[akx]

The single test failure is unrelated:

CondaHTTPError: HTTP 000 CONNECTION FAILED for url <https://conda.anaconda.org/conda-forge/noarch/repodata.json>
Elapsed: -

An HTTP error occurred when trying to retrieve this URL.
HTTP errors are often intermittent, and a simple retry will get you on your way.
'https//conda.anaconda.org/conda-forge/noarch'