Run checks only on changed files

[aexvir]

Instead of scanning the whole repo every time, we should just check the changed files, like pre-commit and many other tools do. We are mostly fine all the time except for tools like bandit, which are quite expensive to run over big codebases.

We can also try to cache some resources for tools that support it