test/upload-pypi : install venv

When we added this test I used ensure-pip in the ensure-twine role to
pull in the pip dependency.  But we soon realised that ensure-twine
ran in a rootless context so couldn't install packages, and reverted
it with I2cf4224228860b8a2cddd360636bb8633967b07e.

However, this testing wasn't fixed up.  Use ensure-pip in the test
playbook before we run the test, and add a note to ensure-twine that
it runs without privileges.

Change-Id: I6aef14b188dce8c4de774b09ddad718fec8fbf6c

roles/ensure-twine/README.rst

@@ -1,5 +1,9 @@
 Ensure twine is installed.
 
+This role is designed to run without permissions, so assumes a working
+Python 3 ``pip`` environment (i.e. it will not install system
+packages).
+
 **Role Variables**
 
 .. zuul:rolevar:: twine_python

test-playbooks/python/upload-pypi.yaml

@@ -1,5 +1,8 @@
 - hosts: all
   tasks:
+    - name: Ensure pip works for ensure-twine
+      include_role:
+        name: ensure-pip
 
     - name: Install twine
       include_role: