CI: pin tox at the project level

New tox has a bunch of incompatibilities -- on master it's worth fixing
things so we can work in the new world, but on stable branches it seems
simplest to keep ourselves in the old world.

Do it at the project level to ensure the pin applies to the
periodic-stable jobs.

Also, skip installing python-dev on jammy.

Also, pin PasteDeploy to 2.1.1 on CentOS 7. This was the last version to
support py27.

Change-Id: I316170442c67c1b4a5b87f9a1168cc04ca2417b8
Related-Change: If69ae0f8eac8fe8ff7d5e4f4f1bff6d0ea9e7a8b
Co-Authored-By: Matthew Vernon <mvernon@wikimedia.org>
(cherry picked from commit cc033154ad)
(cherry picked from commit eb994ea501)

.zuul.yaml

@@ -432,6 +432,8 @@
     vars: *swift_image_vars
 
 - project:
+    vars:
+      ensure_tox_version: '<4'
     templates:
       - publish-openstack-docs-pti
       - periodic-stable-jobs

bindep.txt

@@ -17,7 +17,7 @@ libxslt-devel [platform:rpm]
 libxslt1-dev [platform:dpkg]
 libxslt-dev [platform:apk]
 memcached
-python-dev [platform:dpkg platform:apk]
+python-dev [platform:dpkg platform:apk !platform:ubuntu-jammy]
 python-devel [platform:rpm]
 python3-dev [platform:dpkg platform:apk test]
 python3-devel [platform:fedora platform:suse test]

tools/playbooks/common/install_dependencies.yaml

@@ -34,5 +34,20 @@
     - name: install python modules with pip
       pip: name={{ item }} state=present extra_args='--upgrade'
       with_items:
-        - crudini
+        # For some reason, pip on py2 isn't smart enough to prevent us
+        # trying to install a too-new mock??
+        - 'mock<4'
+        # crudini pulls in iniparse which can conflict with distro-installed
+        # packages on centos7
+        - 'crudini<0.9.4'
+        # Order matters; install constrained versions *first*, then unconstrained
         - eventlet
+
+    - name: install PasteDeploy - CentOS 7
+      pip: name={{ item }} state=present extra_args='--upgrade'
+      with_items:
+        # py2_constraints isn't obeyed by pip install swift
+        - 'PasteDeploy==2.1.1'
+      when:
+        - ansible_facts['distribution'] == "CentOS"
+        - ansible_facts['distribution_major_version'] == "7"