fix: what bandit and the remaining lint rules found

- zip() in provisioning is strict (B905): the OVF asks for one adapter
  per requested NIC, so the two lists match. A VM that came back with
  fewer adapters used to get a seed that left a NIC unconfigured; it now
  fails, and create_vm_from_cloud_init discards it as on any other error
  after the import. A test covers it.
- A failed abort of the import lease is logged at debug level instead of
  passed over (B110); the original error is still the one raised.
- nosec for false positives, each with its reason: the 0.0.0.0 entries in
  the parsers are addresses vSphere reports, not binds (B104); qemu-img
  runs with a fixed argv and no shell (B404, B603); xml.sax.saxutils only
  escapes the OVF descriptor the driver writes, nothing is parsed (B406),
  so defusedxml would not apply.

napalm_vmware/provision/image.py

@@ -12,7 +12,9 @@ import hashlib
 import json
 import os
 import shutil
-import subprocess
+
+# qemu-img is run with a fixed argv and no shell (see below).
+import subprocess  # nosec B404
 import tempfile
 from collections.abc import Callable
 from pathlib import Path
@@ -46,7 +48,8 @@ def fetch(url: str, dest: Path, timeout: float) -> None:  # pragma: no cover - n
 
 
 def convert_to_vmdk(src: Path, dst: Path) -> None:
-    subprocess.run(
+    # Fixed argv, no shell: qemu-img from PATH and the cache's own file paths.
+    subprocess.run(  # nosec B603
         [
             _qemu_img(),
             "convert",
@@ -64,7 +67,8 @@ def convert_to_vmdk(src: Path, dst: Path) -> None:
 
 def virtual_size(path: Path) -> int:
     """The disk size the image describes, in bytes (not the file size)."""
-    out = subprocess.run(
+    # Fixed argv, no shell: qemu-img from PATH and the cache's own file path.
+    out = subprocess.run(  # nosec B603
         [_qemu_img(), "info", "--output", "json", str(path)],
         check=True,
         capture_output=True,