Run bandit over bitmath/ and tests/ as a dedicated GitHub Actions
workflow (push, pull request, weekly) and as part of make ci, so the
local build catches the same issues CI does.

Add the bandit workflow status badge and update the PyPI version and
license badges.

Reorganize and tighten the docsite. listdir() now emits a
DeprecationWarning and will be removed in a future release; getsize()
and listdir() accept pathlib.Path arguments.

Closes #27

Finishes the Python 2 to 3 cleanup of the numeric internals.

- Remove dead Py2-era float() casts from division expressions, where
  Python 3 true division already yields a float
- Force float on the three constructor paths (bytes=, bits=, and the
  Bit value constructor) that previously leaked int, so .bytes and
  .bits return float regardless of how an instance was built
- Add regression tests pinning the float invariant
- Document the uniform float behavior in the Rules for Math appendix
- Add the bitmath-2.1.0 NEWS section and bump VERSION to 2.1.0