fix: what bandit and the remaining lint rules found

- zip() in provisioning is strict (B905): the OVF asks for one adapter
  per requested NIC, so the two lists match. A VM that came back with
  fewer adapters used to get a seed that left a NIC unconfigured; it now
  fails, and create_vm_from_cloud_init discards it as on any other error
  after the import. A test covers it.
- A failed abort of the import lease is logged at debug level instead of
  passed over (B110); the original error is still the one raised.
- nosec for false positives, each with its reason: the 0.0.0.0 entries in
  the parsers are addresses vSphere reports, not binds (B104); qemu-img
  runs with a fixed argv and no shell (B404, B603); xml.sax.saxutils only
  escapes the OVF descriptor the driver writes, nothing is parsed (B406),
  so defusedxml would not apply.

tests/test_provisioning.py

@@ -258,6 +258,13 @@ class TestFinishVm:
         _, spec = self._finish(driver, esxi_data, [{"bridge": "VM Network"}], disk_gb=1)
         assert not any(type(c.device).__name__.endswith("VirtualDisk") for c in spec.deviceChange)
 
+    def test_a_vm_without_an_adapter_per_requested_nic_is_refused(self, driver, esxi_data):
+        # The OVF asks for one adapter per NIC; a VM that came back with fewer would
+        # get a seed that leaves a NIC unconfigured. create_vm_from_cloud_init
+        # discards it on any error from here.
+        with pytest.raises(ValueError):
+            self._finish(driver, esxi_data, [{"bridge": "VM Network"}, {"bridge": "VM Network"}])
+
 
 class TestDestroyAndStatus:
     def test_destroy_powers_off_first(self, driver, esxi_data):