ab03435ad0
Bandit 1.6.0 accidentally changed how the exclusion list option is
handled and breaks our use of it. Cap to the previous version until
Bandit has fixed the problem.
Sphinx 2.0 no longer works on python 2.7, so we need to start
capping it there as well.
Change-Id: Ie6b379f2c99862c37891ac03c52464e07bc2b2cc
(cherry picked from commit 4f467fbd73)