Blacklist bandit 1.6.0 & cap sphinx for 2.7

The latest version of bandit has broken directory
exclusion, so multiple test files are getting
flagged. This change blocks version 1.6.0 while
this issue is fixed for 1.6.1.

This change also caps sphinx at <2.0.0 for python version 2.7.

Change-Id: Id4db764200be068df0dbe96306c2d53f79b49af7

doc/requirements.txt

@@ -5,7 +5,8 @@
 # For generationg sphinx documentation
 openstackdocstheme>=1.18.1 # Apache-2.0
 reno>=2.5.0 # Apache-2.0
-sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2,<2.0.0;python_version=='2.7'  # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2;python_version>='3.4'  # BSD
 
 # For autodoc builds
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0

test-requirements.txt

@@ -6,7 +6,7 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
 flake8-docstrings==0.2.1.post1 # MIT
 flake8-import-order>=0.17.1 #LGPLv3
 
-bandit>=1.1.0 # Apache-2.0
+bandit!=1.6.0,>=1.1.0 # Apache-2.0
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
 mock>=2.0.0 # BSD
@@ -17,7 +17,6 @@ oslotest>=3.2.0 # Apache-2.0
 betamax>=0.7.0 # Apache-2.0
 reno>=2.5.0 # Apache-2.0
 requests-mock>=1.2.0 # Apache-2.0
-sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
 stestr>=1.0.0 # Apache-2.0
 testresources>=2.0.0 # Apache-2.0/BSD
 testtools>=2.2.0 # MIT