False negative: B501 misses `verify=False` on `requests.Session` / `httpx.Client` instance methods

[9iang22]

Describe the bug

B501 currently detects verify=False for module-level calls like requests.get(...) and httpx.get(...), but misses equivalent insecure calls on client/session instances (for example session.get(..., verify=False)).
This creates false negatives for common usage patterns and leaves CWE-295 cases undetected.

Reproduction steps

import httpx
import requests
session = requests.Session()
session.get("https://gmail.com", timeout=30, verify=False)
session.post("https://gmail.com", timeout=30, verify=False)
with requests.Session() as scoped_session:
    scoped_session.put("https://gmail.com", timeout=30, verify=False)
    scoped_session.delete("https://gmail.com", timeout=30, verify=False)
client = httpx.Client(timeout=30)
client.get("https://gmail.com", timeout=30, verify=False)
client.post("https://gmail.com", timeout=30, verify=False)
Run:
bandit -q -r <repro_file.py> -t B501 -f json
Actual result: no B501 findings for the above calls.

Expected behavior

Six alarms should be generated.

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response