#nosec string outside of a comment is treated as a comment

[posita]

From @ehooo in #211 (comment):

Hi I found a bug related with the way that "nosec " comment is checked.
For example vulnerable_call(param="#nosec") this line will be scaped

When fixing this, please do not introduce a regression that prevents use of in-line # nosec comments alongside other source code analyzers' line comment directives? Consider someone who uses Mypy notations, pyflakes, pylint, and bandit:

… # type: … # nosec # noqa: E501 ; pylint: disable=line-too-long

[ericwb]

Here is the culprit:
https://github.com/PyCQA/bandit/blob/master/bandit/core/manager.py#L277

To fix this might require use of Python's tokenize module since the AST doesn't provide info on comments. But using tokenize could result in a performance penalty.