Cap Bandit below 1.6.0 and update Sphinx requirement
Cap Bandit below 1.6.0 and update Sphinx requirement

Bandit 1.6.0 accidentally changed how the exclusion list option is
handled and breaks our use of it. Cap to the previous version until
Bandit has fixed the problem.

Sphinx 2.0 no longer works on python 2.7, so we need to start capping
it there as well.

Change-Id: I24a66b454a28d00f96867fa1b24dd408591b41be
Reference: https://github.com/PyCQA/bandit/pull/489

openstack/oslo.privsep