This is a combination of 2 commits.
1st commit:
Update Sphinx requirement
Sphinx 2.0 no longer works on python 2.7, so we need to start capping
it there as well.
2nd commit:
Fix bandit runs with 1.6.0
The -x option for bandit changed in 1.6.0 and now
supports glob patterns so use that to correctly
exclude test code from bandit scans.
Change-Id: I588d3fb02ef61623affd82a43a54585aba0cb5f9
750547bc33