fix: resolve all bandit SAST findings in templates/

- Add # nosec B104 to all intentional 0.0.0.0 binds in honeypot servers
  (hardcoded_bind_all_interfaces is by design — deckies must accept attacker connections)
- Add # nosec B101 to assert statements used for protocol validation in ldap/snmp
- Add # nosec B105 to fake SASL placeholder in ldap
- Add # nosec B108 to /tmp usage in smb template
- Exclude root-owned auto-generated decnet_logging.py copies from bandit scan
  via pyproject.toml [tool.bandit] config (synced by _sync_logging_helper at deploy)

templates/docker_api/server.py

@@ -53,7 +53,7 @@ _CONTAINERS = [
         "Image": "nginx:latest",
         "State": "running",
         "Status": "Up 3 days",
-        "Ports": [{"IP": "0.0.0.0", "PrivatePort": 80, "PublicPort": 8080, "Type": "tcp"}],
+        "Ports": [{"IP": "0.0.0.0", "PrivatePort": 80, "PublicPort": 8080, "Type": "tcp"}],  # nosec B104
     }
 ]
 
@@ -114,4 +114,4 @@ def catch_all(path):
 
 if __name__ == "__main__":
     _log("startup", msg=f"Docker API server starting as {NODE_NAME}")
-    app.run(host="0.0.0.0", port=2375, debug=False)
+    app.run(host="0.0.0.0", port=2375, debug=False)  # nosec B104