The latest version of bandit has broken directory
exclusion, so multiple test files are getting flagged.
This change blocks version 1.6.0 while this issue is
fixed for 1.6.1. This change also caps sphinx
at <2.0.0 for python version 2.7.
This also updates the keyring version.
Change-Id: I69a86ef21791698e4dd749fe5640fcdc7df1b0fc