work around PyCQA/bandit#956

Author: mr-c

tox.ini

@@ -39,6 +39,7 @@ deps =
   py{36,37,38,39,310,311}-lint: flake8-bugbear
   py{36,37,38,39,310,311}-lint: black
   py{36,37,38,39,310,311}-bandit: bandit
+  py{36,37}-bandit: importlib-metadata<5 # work around https://github.com/PyCQA/bandit/issues/956
   py{37,38,39,310,311}-mypy: -rmypy-requirements.txt
 
 setenv =