security: remove bandit_results.json and semgrep_results.json from repo

[realityinspector]

Problem

bandit_results.json and semgrep_results.json are tracked in git. They contain 20+ local filesystem paths (/Users/seanmcdonald/...) exposing the developer's macOS username and directory structure.

Fix

1. Remove both files from the working tree
2. Add bandit_results.json and semgrep_results.json to .gitignore
3. These should also be removed from git history eventually (Phase 3 history rewrite), but removing from HEAD is the immediate fix

PPI Database Reference

Listed as P1 in ppi-leak-database.md since 2026-03-02.