Cap bandit to v1.6.2

We don't have test requirements in upper-constraints, so we need
to cap it in stable branches manually to work with Python 2.7.

Change-Id: Ie597e778e3efa61bfd98eaaa92730b5050195e7a
(cherry picked from commit a512bfc233)
(cherry picked from commit 7f77de0519)

test-requirements.txt

@@ -19,4 +19,4 @@ testresources>=2.0.0 # Apache-2.0/BSD
 testscenarios>=0.4 # Apache-2.0/BSD
 oslo.versionedobjects[fixtures]>=1.31.2 # Apache-2.0
 tempest>=17.1.0 # Apache-2.0
-bandit>=1.1.0 # Apache-2.0
+bandit>=1.1.0,<1.6.3 # Apache-2.0