The latest version of bandit has broken directory exclusion,
so multiple test files are getting flagged. This change
blocks version 1.6.0 while this issue is fixed for 1.6.1.
This change also caps sphinx at <2.0.0 for python version 2.7.
Change-Id: I5d32d835886360522af21f735c74b2f85036f7f1