Fix lower-constraints job

pip 20.3 finally includes a proper dependency resolver. Its use is
causing the following error messages on the lower-constraints job:

  ERROR: Could not find a version that satisfies the requirement
  hacking<3.1.0,>=3.0.1
  ERROR: No matching distribution found for hacking<3.1.0,>=3.0.1

Resolve this by moving the 'hacking' and 'flake8-import-order'
dependencies from 'test-requirements.txt' to 'tox.ini' since we don't
need to use our constraints machinery for linters.

While we're here, also drop 'bandit' from 'test-requirements.txt'. This
was introduced in change I691829c1224557d1d239c9f665ac539d0f13c4d3 but
commit f78173f0e1 (there's no change ID)
removed the 'bandit' testenv from 'tox.ini' meaning we no longer use
this anywhere.

Change-Id: I744efd75c4cbf8c630c5f95dc254acff581be959
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>

test-requirements.txt

@@ -1,7 +1,6 @@
 # The order of packages is significant, because pip processes them in the order
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
-hacking>=3.0.1,<3.1.0 # Apache-2.0
 
 coverage!=4.4,>=4.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
@@ -11,5 +10,3 @@ stestr>=1.0.0 # Apache-2.0
 testrepository>=0.0.18 # Apache-2.0/BSD
 testtools>=2.2.0 # MIT
 osprofiler>=1.4.0 # Apache-2.0
-bandit>=1.1.0 # Apache-2.0
-flake8-import-order>=0.17.1 # LGPLv3

tox.ini

@@ -28,6 +28,9 @@ commands =
 whitelist_externals = stestr
 
 [testenv:pep8]
+deps =
+  hacking>=3.0.1,<3.1.0 # Apache-2.0
+  flake8-import-order>=0.17.1 # LGPLv3
 commands = flake8
 
 [testenv:venv]