Cap Bandit below 1.6.0 and update Sphinx requirement
Cap Bandit below 1.6.0 and update Sphinx requirement

Bandit 1.6.0 accidentally changed how the exclusion list option is
handled and breaks our use of it. Cap to the previous version until
Bandit has fixed the problem.

Sphinx 2.0 no longer works on python 2.7, so we need to start capping
it there as well.

Change-Id: I659571d084247a6a180d5b665921791d3647038f
Reference: https://github.com/PyCQA/bandit/pull/489

openstack/castellan,openstack/castellan