Pin Bandit on py2

...and, since the previous tag didn't have the Bandit pin, make the
rolling upgrade job non-voting. We should plan on backporting this so we
can check that upgrades from stable branches are still OK.

See also: https://github.com/PyCQA/bandit/issues/654

Change-Id: If7f3ad8b275271d748426133232ed06c2a1cd1de

.zuul.yaml

@@ -548,6 +548,7 @@
               - ^(api-ref|doc|releasenotes)/.*$
               - ^test/probe/.*$
               - ^(.gitreview|.mailmap|AUTHORS|CHANGELOG|.*\.rst)$
+            voting: false
         - tempest-integrated-object-storage:
             irrelevant-files:
               - ^(api-ref|doc|releasenotes)/.*$

py2-constraints.txt

@@ -70,4 +70,7 @@ greenlet===0.4.15
 oslo.utils===3.42.1
 gitdb===0.6.4
 gitdb2===2.0.6
+
+# Projects that are known to have had a final py2-supporting release
+bandit===1.6.2
 python-keystoneclient===3.22.0