Add flake8 (with dlint) tests to CI

[defnull]

#1194 showed that adopting properly configured static analysis might help prevent some serious bugs. There are lots of style warnings and false-positives currently when running flake8. Some are fixable, but some warnings could also simply be disabled.

[mschwager]

Hey, glad to see this change!

Regarding false-positives from flake8: if you simply want to include Dlint to search for potential security issues and bugs you can run python -m flake8 --select=DUO, to run all flake8 checks, including stylistic ones, you can omit the --select=DUO.

Generally I find running all the flake8 checks useful for conforming to a certain style (i.e. PEP8), and finding some basic issues like unused imports and unused variables. If you'd like to quickly move your codebase to flake8 conformance I'd take a look at autopep8 and autoflake.

Regarding Dlint's other findings:

$ python -m flake8 --select=DUO bottle.py 
bottle.py:160:5: DUO105 use of "exec" is insecure
bottle.py:160:10: DUO110 use of "compile" is insecure
bottle.py:2922:16: DUO130 insecure use of "hashlib" module
bottle.py:3616:12: DUO104 use of "eval" is insecure
bottle.py:3965:16: DUO110 use of "compile" is insecure
bottle.py:4007:9: DUO105 use of "exec" is insecure

If you don't believe these are security issues, then I'd ignore them inline.

Happy to help here if you'd like!