fix: what bandit and the remaining lint rules found

- nosec for the staging path on the device (B108); it is a mktemp
  template on the remote host, not a local temp file.
- The wildcard listen addresses parsed from sockstat/netstat are named
  constants with a nosec (B104): reported data, never a bind. The output
  is unchanged.
- ruff found nothing left after the mechanical pass.

napalm_bsd/base.py

@@ -55,7 +55,8 @@ _PRIVILEGED_STDIN = (
 
 #: Stages content without privilege: a fresh ``mktemp`` file only the login user
 #: may read, never a fixed name another user could create first. Prints its path.
-_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX"
+#: The path is on the device, not a local temp file.
+_STAGE_TEMPLATE = "/tmp/napalm-bsd-stage.XXXXXX"  # nosec B108
 _STAGE_PREFIX = _STAGE_TEMPLATE[: -len("XXXXXX")]
 _STAGE = (
     f"umask 077 && t=$(mktemp {_STAGE_TEMPLATE}) && "

napalm_bsd/parse.py

@@ -259,6 +259,11 @@ def boottime(text: str) -> int | None:
     return int(match[1]) if match else None
 
 
+#: The wildcard addresses a socket listens on: reported as data, never bound to.
+_ANY_V4 = "0.0.0.0"  # nosec B104
+_ANY_V6 = "::"
+
+
 def _socket(
     proto: str, local: str, family: str, process: str | None, pid: int | None
 ) -> dict[str, Any] | None:
@@ -275,7 +280,7 @@ def _socket(
         return None
     address, _, zone = address.partition("%")
     if address == "*":
-        address = "0.0.0.0" if family == "4" else "::"
+        address = _ANY_V4 if family == "4" else _ANY_V6
     return {
         "proto": proto,
         "address": address,