ini "exclude" config is ignored

Describe the bug exclude configuration inside .bandit ini file is always ignored due to default cli argument.

To Reproduce Steps to reproduce the behavior:

1. Create . bandit file with the following.

[bandit]
targets: .
exclude: ./tests

1. Run CLI with bandit --ini .bandit -r in a directory with .bandit file.
2. You should now see that Bandit is prefer CLI argument for exclude over ini.

[main]	INFO	Using command line arg for excluded paths
[main]	INFO	Using ini file for selected targets

Expected behavior Bandit should use .bandit configuration as there’s no CLI argument supplied then append default value to it as specified in argparse.

  -x EXCLUDED_PATHS, --exclude EXCLUDED_PATHS
                        comma-separated list of paths (glob patterns supported) to exclude
                        from scan (note that these are in addition to the excluded paths
                        provided in the config file) (default:
                        .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)

Bandit version

bandit 1.7.0
  python version = 3.8.0 (default, Sep  3 2020, 18:08:13) [Clang 11.0.3 (clang-1103.0.32.62)]

Additional context I believe this happens due to the default value for -x given to argparse. This means the ini configuration is always ignored as the code take default value as supplied CLI.

Workaround Supplied exclude via CLI when running Bandit regardless of your ini. bandit -x ./tests --ini .bandit -r .

[bsolomon1124]

Coupled with https://github.com/PyCQA/bandit/issues/595, https://github.com/PyCQA/bandit/issues/657, and https://github.com/PyCQA/bandit/issues/488 (unceremoniously closed for no reason), I’d venture to say ‘exclude’ is pretty much nonfunctional at this point.

[stuertz]

As a workaoround I call bandit -x "" So that _log_option_source doesn’t get the defaults. Or for .pre-commit-config.yaml:

    - repo: https://github.com/PyCQA/bandit
      rev: 1.7.0
      hooks:
          - id: bandit
            args: ['--ini', '.bandit', '-x', '']