Run flake8/bandit on sources only
    
    Limit it to know subdirectories only. This change prevents linting in
    any virtualenv that may be present in the git checkout, and which would
    take ages to process.
    
    Signed-off-by: Lubomír Sedlář <lsedlar@redhat.com>