Cap bandit below 1.6.0 version and update sphinx and limit monotonic.

Bandit 1.6.0 accidentally changed how to exclusion list option is
handled and breaks our use of it. Cap to the previous version until
bandit has has fixed the problem.

Sphinx 2.0 no longer works on python 2.7, so need to start capping it
there as well.

Limit monotonic to python < 3.3 and reflect the changes to
openstack/requirements introduced
in change Ib8c1bf08f5fa7463911602b0df19315907c81e04.

Co-Authored-By: Stephen Finucane <sfinucan@redhat.com>
Co-Authored-By: Hervé Beraud <hberaud@redhat.com>

Change-Id: I4c2a19fae55e8cfea2d5ae9603a1fb086b5db1bf

doc/requirements.txt

@@ -2,6 +2,7 @@
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
 
-sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2,<2.0.0;python_version=='2.7' # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2;python_version>='3.4' # BSD
 openstackdocstheme>=1.18.1 # Apache-2.0
 reno>=2.5.0 # Apache-2.0

lower-constraints.txt

@@ -23,7 +23,7 @@ linecache2==1.0.0
 MarkupSafe==1.0
 mccabe==0.2.1
 mock==2.0.0
-monotonic==1.4
+monotonic==1.4;python_version<'3.3'
 mox3==0.25.0
 msgpack==0.5.6
 netaddr==0.7.19

requirements.txt

@@ -12,4 +12,4 @@ oslo.serialization>=2.25.0 # Apache-2.0
 debtcollector>=1.19.0 # Apache-2.0
 pyinotify>=0.9.6;sys_platform!='win32' and sys_platform!='darwin' and sys_platform!='sunos5' # MIT
 python-dateutil>=2.7.0 # BSD
-monotonic>=1.4 # Apache-2.0
+monotonic>=1.4;python_version<'3.3' # Apache-2.0

test-requirements.txt

@@ -15,4 +15,4 @@ oslotest>=3.3.0 # Apache-2.0
 coverage>=4.5.1 # Apache-2.0
 
 # Bandit security code scanner
-bandit>=1.1.0 # Apache-2.0
+bandit>=1.1.0,<1.6.0 # Apache-2.0