Bandit 1.6.0 no longer respects excluded directories

Describe the bug Prior to the bandit 1.6.0 release, I was using bandit like so:

bandit -r . -x ./mymodule1/tests/,./mymodule2/tests/

However, with bandit 1.6.0 the ./mymodule1/tests/ and ./mymodule2/tests/ directories are included in the results. I have confirmed that you can exclude individual files still, just not directories.

To Reproduce Steps to reproduce the behavior:

1. Create a directory with a vulnerability in it somewhere
2. Run bandir -r . -x ./your-new-dir/
3. See vulnerability results that should be excluded

Expected behavior Bandit should be excluding the directories entirely that are passed as args to the -x flag.

Bandit version

bandit 1.6.0
  python version = 3.6.5 (default, Jun 17 2018, 12:13:06) [GCC 4.2.1 Compatible Apple LLVM 9.1.0 (clang-902.0.39.2)]

[bsolomon1124]

This issue still exists nearly one year later on Bandit 1.6.2. Unclear why it is closed.

While it makes very little sense, -x or --exclude seems to require a ./-prefaced relative path.

E.g. if you have a venv in your current directory:

python -m bandit --exclude ./venv --recursive --output bandit.json --format json .

will work as intended whereas

python -m bandit --exclude venv --recursive --output bandit.json --format json .
python -m bandit --exclude "${PWD}/venv" --recursive --output bandit.json --format json .

Will attempt to scan all of venv/.

The current arg is:

    parser.add_argument(
        '-x', '--exclude', dest='excluded_paths', action='store',
        default=','.join(constants.EXCLUDE),
        help='comma-separated list of paths (glob patterns '
             'supported) to exclude from scan '
             '(note that these are in addition to the excluded '
             'paths provided in the config file) (default: ' +
        ','.join(constants.EXCLUDE) + ')'
    )

Which gets passed to discover_files():

https://github.com/PyCQA/bandit/blob/c6b1302e7b1ab1ad78799264d8ca7222f2c3d428/bandit/cli/main.py#L457

Independent of this issue, it might be sensible to add venv to constants.EXCLUDE.

[bsolomon1124]

@ericwb please reopen based on ample evidence above.