fix: what bandit and the remaining lint rules found

- zip() in provisioning is strict (B905): the OVF asks for one adapter
  per requested NIC, so the two lists match. A VM that came back with
  fewer adapters used to get a seed that left a NIC unconfigured; it now
  fails, and create_vm_from_cloud_init discards it as on any other error
  after the import. A test covers it.
- A failed abort of the import lease is logged at debug level instead of
  passed over (B110); the original error is still the one raised.
- nosec for false positives, each with its reason: the 0.0.0.0 entries in
  the parsers are addresses vSphere reports, not binds (B104); qemu-img
  runs with a fixed argv and no shell (B404, B603); xml.sax.saxutils only
  escapes the OVF descriptor the driver writes, nothing is parsed (B406),
  so defusedxml would not apply.

napalm_vmware/parse/hosts.py

@@ -11,7 +11,8 @@ from typing import Any
 from napalm_device_types.models import HypervisorHostDict
 
 _CONNECTED = "connected"
-_UNMANAGED = {None, "", "0.0.0.0"}
+# Addresses vSphere reports for "no managing vCenter"; data, not a bind.
+_UNMANAGED = {None, "", "0.0.0.0"}  # nosec B104
 
 
 def _host(host: dict[str, Any], standalone: bool) -> HypervisorHostDict: