Fix B106 reporting wrong line number on multiline function calls - #1360

Summary

Fixes #1328.

B106 (hardcoded_password_funcarg) reported the line number of the ast.Call node rather than the line of the specific keyword argument containing the hardcoded password. For multiline function calls, this meant:

• The reported location pointed to the function call start, not the actual password
• # nosec B106 placed on the correct line (with the password) was ineffective
• # nosec B106 on the reported line (function call) silenced the warning but was misleading

Fix

Pass kw.value.lineno to the Issue constructor so the reported location points to the actual hardcoded string, not the call.

Before

>> Issue: [B106:hardcoded_password_funcarg] Possible hardcoded password: 'on_behalf_of'
   Location: ./auth.py:8:15    <-- line of dict( call

After

>> Issue: [B106:hardcoded_password_funcarg] Possible hardcoded password: 'on_behalf_of'
   Location: ./auth.py:12:15   <-- line of requested_token_use="on_behalf_of"

Test plan

• Existing test_hardcoded_passwords functional test passes (issue counts unchanged)
• Verified manually: before fix reports line 8, after fix reports line 12
• Verified # nosec B106 on the keyword line now works correctly

🤖 Generated with Claude Code