Add test duration in the reporter about bandit

[sbeyer]

I consider it a feature to not have duration information included, so outputs can be compared (e.g. with diff). Hence creating a new reporter would be the way that I prefer. If you want to make a PR for that, feel free. Please try to minimize code duplication.

Another way could be to add a --report-timing option (or a better name) that is passed to the reporters and they then handle the user's desire to see test execution durations. I am not sure if this makes sense with every reporter and how xunit should behave without that option.

[sbeyer]

(I added the inaction tag because I won't implement it. But I'm open to review and merge PRs.)