Update to ansible-lint 4.1.0

In a follow-on change (I9bf74df351e056791ed817180436617048224d2c) I
want to use #noqa to ignore an ansible-lint rule on a task; however
emperical testing shows that it doesn't work with 3.5.1.  Upgrading to
4.1.0 it seems whatever was wrong has been fixed.

This, however, requires upgrading to 4.1.0.

I've been through the errors ... the comments inline I think justify
what has been turned off.  The two legitimate variable space issues I
have rolled into this change; all other hits were false positives as
described.

Change-Id: I7752648aa2d1728749390cf4f38459c1032c0877

playbooks/zuul/run-base-post.yaml

@@ -30,7 +30,7 @@
 
     - name: Save container logs
       loop: "{{ docker_containers.stdout_lines | default([]) }}"
-      shell: "docker logs {{ item }} &> /var/log/docker/{{item}}.txt"
+      shell: "docker logs {{ item }} &> /var/log/docker/{{ item }}.txt"
       args:
         executable: /bin/bash
       become: true

roles/kerberos-client/tasks/main.yaml

@@ -33,7 +33,7 @@
   vars:
     params:
       files:
-        - "{{ansible_distribution}}.yaml"
+        - "{{ ansible_distribution }}.yaml"
         - "default.yaml"
       paths:
         - install-packages

test-requirements.txt

@@ -4,7 +4,7 @@
 hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
 bashate>=0.2 # Apache-2.0
 PyYAML>=3.10.0 # MIT
-ansible-lint<4.0.0
+ansible-lint>=4.1.0
 openstacksdk
 zuul-sphinx>=0.2.3
 testtools

tox.ini

@@ -22,10 +22,26 @@ commands =
   #
   # ANSIBLE0010: Package installs should not use latest
   #  We often deploy latest pip packages
+  #
+  # 204: Lines < 160
+  #  Things like keys, script lines, etc exceed this.  We have good
+  #  taste and only use long lines where appropriate.
+  #
+  # 206: {{var}} should have spaces {{ var }}
+  #  This rule seems sane, but it appears there's no way to convince
+  #  ansible-lint perfectly good things that are *not* ansible (like
+  #  exim configs) in YAML shouldn't have to follow this rule.  See
+  #  https://github.com/ansible/ansible-lint/issues/534; might be able
+  #  to turn on if fixed.
+  #
+  # 306: shells with pipes should use pipefail
+  #  This requires running the shell as /bin/bash.  There is a small
+  #  possibility to hide errors, but we can rely on
+  #  developers to decide when to explicitly check for failures.
   bash -c "find roles playbooks -type f -regex '.*.y[a]?ml' -print0 | xargs -t -n1 -0 \
     ansible-lint -x ANSIBLE0004 -x ANSIBLE0006 -x ANSIBLE0007 -x ANSIBLE0010 \
                  -x ANSIBLE0011 -x ANSIBLE0012 -x ANSIBLE0013 -x ANSIBLE0015 \
-                 -x 304"
+                 -x 204 -x 206 -x 304 -x 306"
 
 [testenv:venv]
 commands = {posargs}