Add GitHub Action unit testing of Python 3.9 and add to our supported
list of Python versions.

This patch also fixes some Py39 related issues. Namely:
* A hardcoded password such as d["password"] = "blerg" in examples/hardcoded-passwords.py
  goes undetected. This is due to a change in behavior of the Py3.9 AST.
* The README does match the output of bandit -h. Specially the targets is now
  [targets ...] instead of [targets [targets ...]]. This was introduced with Python
  fix: https://bugs.python.org/issue38438. As a result, the README no longer contains
  output of -h and the unit test to make sure they match is gone.

Signed-off-by: Eric Brown <browne@vmware.com>