[stable-only] Pin tox <4

Continue to use tox 3 in the stable branches.

Two changes:
- .zuul.yaml: set the ensure_tox_version to use <4, which will
  tell zuul to install tox<4 if it's not present
- tox.ini: set requires=tox<4 so that if tox has been installed
  already, our tox-based jobs will use tox 3 to run the tests

Change-Id: Ica4c0a1d4f861e528ce8995766e82541dc710e0f
(cherry picked from commit 22a3169576)
(cherry picked from commit e3799da555)
(cherry picked from commit 64943b71b0)

.zuul.yaml

@@ -29,6 +29,8 @@
       tox_envlist: functional-py38
 
 - project:
+    vars:
+      ensure_tox_version: '<4'
     templates:
       - check-requirements
       - lib-forward-testing-python3

tox.ini

@@ -2,6 +2,7 @@
 distribute = False
 envlist = py3,pep8
 minversion = 3.18.0
+requires = tox<4
 skipsdist = True
 # this allows tox to infer the base python from the environment name
 # and override any basepython configured in this file