Clamp bandit for python 3.6

A new version of bandit was released which drops python 3.6
support, so it needs to be clamped in test-requirements.txt

Bandit cannot easily be run in newer versions of python

Story: 2008943
Task: 45080
Signed-off-by: Al Bailey <al.bailey@windriver.com>
Change-Id: If98cdcaf9d39b0cf6e254a0e705094c9f5ed9fe0

sysinv/sysinv/sysinv/test-requirements.txt

@@ -3,7 +3,7 @@
 # process, which may cause wedges in the gate later.
 hacking>=1.1.0,<=2.0.0 # Apache-2.0
 astroid <= 2.2.5
-bandit;python_version>="3.0"
+bandit<1.7.2;python_version>="3.0"
 coverage>=3.6
 fixtures>=3.0.0 # Apache-2.0/BSD
 mock>=2.0.0 # BSD

sysinv/sysinv/sysinv/tox.ini

@@ -169,7 +169,7 @@ skips = B101,B103,B104,B105,B108,B110,B303,B307,B310,B311,B314,B318,B320,B404,B4
 exclude = tests
 
 [testenv:bandit]
-basepython = python3
+basepython = python3.6
 deps = -r{toxinidir}/test-requirements.txt
 commands = bandit --ini tox.ini -n 5 -r sysinv