test-requirements: bump to Ansible 2.8

We are outside the 4 week period that we dropped Ansible 2.7
(I13802db3314450ad149fdadacd1e2e70dd8468ef) so update the testing
version to 2.8 here.

The comment has become stale, as ansible-lint is now installed via
linters-requirements.txt; remove the bit about how it will pull in the
latest version of Ansible.  Also clarify slightly the version usage.

Later versions of Ansible only have paramiko support as a plugin.  We
have just one place we use it explicitly to generate some keys for
testing; so it is really a dependency of zuul-jobs.  Add it
explicitly.

Change-Id: Iad8622594a773af78487dec88e4ce5cc48806ded

test-requirements.txt

@@ -3,13 +3,11 @@
 # process, which may cause wedges in the gate later.
 
 # We need to pin the ansible version directly here; per the
-# deprecation policy it should trail the version used by Zuul by 4
+# deprecation policy it should trail the lowest version used by Zuul
-# weeks to give people time to update before these roles start
+# by 4 weeks to give people time to update before any roles start
-# depending on new features.  Also note we can't just include zuul
+# depending on new features.
-# here to pull in ansible anyway; pip doesn't actually have a
+
-# dependency solver and the uncapped ansible requirement from
+ansible>=2.8,<2.9
-# ansible-lint pull in the latest version.
-ansible>=2.7,<2.8 # https://review.opendev.org/#/c/727157/
 stestr>=1.0.0,<3.0.0;python_version<'3.5' # Apache-2.0
 stestr>=1.0.0;python_version>='3.5' # Apache-2.0
 
@@ -53,3 +51,6 @@ mock;python_version<'3.3'
 
 # voluptuous dropped support for py27
 voluptuous<0.13.0;python_version=='2.7'
+
+# for remove-zuul-sshkey
+paramiko