Fix bandit and sphinx requirements for stable branches

This is a combination of 2 commits.

1st commit:
Update Sphinx requirement
Sphinx 2.0 no longer works on python 2.7, so we need to start capping
it there as well.

2nd commit:
Fix bandit runs with 1.6.0
The -x option for bandit changed in 1.6.0 and now
supports glob patterns so use that to correctly
exclude test code from bandit scans.

Change-Id: I588d3fb02ef61623affd82a43a54585aba0cb5f9

requirements.txt

@@ -45,5 +45,7 @@ stevedore>=1.28.0 # Apache-2.0
 taskflow>=3.1.0 # Apache-2.0
 WebOb>=1.7.4 # MIT
 WSME>=0.9.2 # MIT
-networkx>=1.11 # BSD
+# NOTE(fdegir): NetworkX 2.3 dropped support for Python 2
+networkx>=1.11,<2.3;python_version<'3.0'  # BSD
+networkx>=1.11;python_version>='3.4' # BSD
 microversion_parse>=0.2.1 # Apache-2.0