Tox4: add allowlist_externals where necessary

With tox4 allowlist_externals is more strictly checked, so
fix it where necessary and fix pylint version.

Depends-On: https://review.opendev.org/c/zuul/zuul-jobs/+/866943
Related-Bug: #1999558

Change-Id: Id115a436b95b3ede5a1f3102b4bb9e3ade75c970

doc/requirements.txt

@@ -4,3 +4,4 @@
 openstackdocstheme>=2.2.0 # Apache-2.0
 reno>=3.1.0 # Apache-2.0
 sphinx>=2.0.0,!=2.1.0 # BSD
+cliff>=3.4.0 # Apache-2.0

tox.ini

@@ -1,7 +1,7 @@
 [tox]
 envlist = py39,pep8
 minversion = 3.18.0
-skipsdist = True
+skipsdist = False
 ignore_basepython_conflict = True
 
 [testenv]
@@ -12,18 +12,17 @@ setenv = VIRTUAL_ENV={envdir}
          LC_ALL=C
          PYTHONWARNINGS=default::DeprecationWarning
 usedevelop = True
-install_command = pip install {opts} {packages}
 deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
        -r{toxinidir}/requirements.txt
        -r{toxinidir}/test-requirements.txt
 # Delete bytecodes from normal directories before running tests.
 # Note that bytecodes in dot directories will not be deleted
 # to keep bytecodes of python modules installed into virtualenvs.
-commands = sh -c "find . -type d -name '.?*' -prune -o \
+commands = bash -c "find . -type d -name '.?*' -prune -o \
            \( -type d -name '__pycache__' -o -type f -name '*.py[co]' \) \
            -print0 | xargs -0 rm -rf"
            stestr run {posargs}
-allowlist_externals = sh
+allowlist_externals = bash
 
 [testenv:pep8]
 commands =