Limit PR Bandit scan to changed files

[Copilot]

The DLS SCAN: Bandit job failed because it scanned the entire repository (scan-scope: all) and surfaced existing Medium findings unrelated to the PR. This update narrows the PR workflow to evaluate only files changed in the pull request.

• Workflow scope correction

  • Updated Bandit invocation in .github/workflows/dls-pr-workflow.yaml from full-repo scan to changed-files scan.
  • Preserves existing severity/confidence thresholds and fail-on-findings behavior for relevant PR diffs.

• Impact

  • Prevents unrelated baseline findings from blocking PRs.
  • Keeps Bandit as an effective gate on newly introduced or modified code.

# .github/workflows/dls-pr-workflow.yaml
with:
  scan-scope: "changed"   # was "all"
  severity-level: "MEDIUM"
  confidence-level: "MEDIUM"
  fail-on-findings: true