Update CI

Note the check-style job can be removed once
the pre-commit.ci bot is enabled

.github/workflows/ci.yml

@@ -24,7 +24,6 @@ jobs:
     with:
       envs: |
         - linux: check-style
-        - linux: check-security
         - linux: check-build
   test:
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1

tox.ini

@@ -1,6 +1,6 @@
 [tox]
 envlist =
-    check-{style,security,build}
+    check-{style,build}
     test{,-warnings,-cov}-xdist
     test-numpy{120,121,122}
     test-{jwst,romancal}-xdist
@@ -19,17 +19,10 @@ envlist =
 description = check code style, e.g. with ruff
 skip_install = true
 deps =
-    ruff
+    pre-commit
 commands =
-    ruff . {posargs}
-
-[testenv:check-security]
-description = run bandit to check security compliance
-skip_install = true
-deps =
-    bandit>=1.7
-commands =
-    bandit stcal -r -x src,tests
+    pre-commit install-hooks
+    pre-commit run {posargs:--color always --all-files --show-diff-on-failure}
 
 [testenv:check-build]
 description = check build sdist/wheel and a strict twine check for metadata