fix: what bandit and the remaining lint rules found

- nosec for the staging path on the device (B108); it is a mktemp
  template on the remote host, not a local temp file.
- The wildcard listen addresses parsed from sockstat/netstat are named
  constants with a nosec (B104): reported data, never a bind. The output
  is unchanged.
- ruff found nothing left after the mechanical pass.

napalm_bsd/base.py

@@ -55,7 +55,8 @@ _PRIVILEGED_STDIN = (
 
 #: Stages content without privilege: a fresh ``mktemp`` file only the login user
 #: may read, never a fixed name another user could create first. Prints its path.
-_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX"
+#: The path is on the device, not a local temp file.
+_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX"  # nosec B108
 _STAGE_PREFIX = _STAGE_TEMPLATE[: -len("XXXXXX")]
 _STAGE = (
     f"umask 077 && t=$(mktemp {_STAGE_TEMPLATE}) && "