[stable-only] Pin tox <4

Continue to use tox 3 until we decide how to do the transition
to tox 4 in the stable branches.  Two changes:

- .zuul.yaml: set the ensure_tox_version to use <4, which will
  tell the host to install a tox 3 package ... but:
- tox.ini: from experimentation, it looks like if tox needs to
  install anything from the 'requires' key in the core section,
  it will also upgrade itself (in the .tox/.tox directory) to
  the latest tox version, so add a cap on tox to the 'requires'
  list

Change-Id: I3c22ff2d6e2951c6a8ba110d4393a399480e0f3f
(cherry picked from commit 426f6337b6)

.zuul.yaml

@@ -1,4 +1,6 @@
 - project:
+    vars:
+      ensure_tox_version: '<4'
     templates:
       - openstack-python3-yoga-jobs
       - openstack-python3-yoga-jobs-arm64

tox.ini

@@ -1,6 +1,8 @@
 [tox]
 minversion = 3.18.0
-requires = virtualenv>=20.4.2
+requires =
+    virtualenv>=20.4.2
+    tox<4
 skipsdist = True
 # python runtimes: https://governance.openstack.org/tc/reference/project-testing-interface.html#tested-runtimes
 envlist = py3,compliance,pep8