Use target name in hardcoded-password diagnostics

[charliermarsh]

#3511 mentioned some false positives for Bandit's "hardcoded password" rules. I think the confusion is that those rules test the target to determine whether a string might be a hardcoded password, but the diagnostics report the value. So, e.g., if you have api_token = "foo", it tells you that there's a Possible hardcoded password: "foo", rather than that the cause is assigning to api_token.

There are still some false positives (e.g., in torchmetrics, they have split_token, which gets flagged here), but we can only avoid those via special-casing. Making the diagnostics clearer at least provides the proper context.

Closes #3511.