This patch has multiple fixes to unblock gate.
We don't have bandit requirements in upper-constraints, so we need
to cap it in stable branches manually to work with Python 2.7, as
bandit 1.6.3  release has dropped support for py2  but the
release is faulty and pip still picks it up for py2 .
2. pip resolver
With the new pip resolver the following issues needed to be fixed:
* SQLAlchemy-Utils constraint conflicts with rocky's upper constraints
* bump lower constraint of cryptography
* bump lower constraint of oslo.messaging
* bump lower constraint of oslo.utils
In lower-constraints job lxml requires libxml2-dev and libxslt1-dev
packages, so bindep.txt is extended with them.
install_command needs to be added to lower-constraints tox target to
Fix for overlapping CIDR issue in cinder-tempest-dsvm-lvm-lio-barbican
is the same as in patch I068cf1e9618d305b5a9383c283bfa0f120bfe905.
5. pin nodeset to xenial for requirements-check job
The default nodeset for zuul jobs is now ubuntu-focal, and
requirements-check job fails on focal, because the mysql it contains is
not compatible with the commands that is used in tools/test-setup.sh.
This patch pins the nodeset to ubuntu-xenial for requirements-check job
to make it pass.
(cherry picked from commit