Add structured nosec directives for regions and next line

Normalized profile

What this task asks for

Add region and next-line nosec directives with selector expressions and ignore-nosec handling. Bandit can suppress findings with inline # nosec, but it cannot currently suppress a whole span of code or just the next statement without repeating inline markers. Add directives for region suppression and next-statement suppression. Each directive accepts an optional selector argument written directly after the directive keyword with no keyword prefix (e.g. # nosec-begin B602, # nosec-next-line B602). If a region begin directive appears on an indented line and is not explicitly ended, it automatically ends when a later line has smaller indentation (based on leading whitespace of the line, not the column position of the directive itself). All directive types must be ignored when Bandit is run with ignore-nosec enabled. All applicable suppressions for a finding must be combined.