Keystone jobs should honor upper-constraints.txt

Some targets don't respect upper-constraints like
cover and releasenotes, so make sure don't use
the same install_command for those jobs.

Change-Id: I8636e7c86c6c5c608429fab88e181108ae615db9
(cherry picked from commit db7bdf9aa0)

tox.ini

@@ -5,7 +5,7 @@ envlist = py34,py27,pep8,docs,genconfig,releasenotes
 
 [testenv]
 usedevelop = True
-install_command = pip install -U {opts} {packages}
+install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/mitaka} {opts} {packages}
 setenv = VIRTUAL_ENV={envdir}
 deps = -r{toxinidir}/test-requirements.txt
        .[ldap,memcache,mongodb]
@@ -60,6 +60,12 @@ deps = .[bandit]
 commands = bandit -r keystone -x tests
 
 [testenv:cover]
+# Also do not run test_coverage_ext tests while gathering coverage as those
+# tests conflict with coverage.
+# NOTE(sdague): this target does not use constraints because
+# upstream infra does not yet support it. Once that's fixed, we can
+# drop the install_command.
+install_command = pip install -U --force-reinstall {opts} {packages}
 commands =
   find keystone -type f -name "*.pyc" -delete
   python setup.py testr --coverage --testr-args='{posargs}'
@@ -127,6 +133,10 @@ commands=
     python setup.py build_sphinx
 
 [testenv:releasenotes]
+# NOTE(sdague): this target does not use constraints because
+# upstream infra does not yet support it. Once that's fixed, we can
+# drop the install_command.
+install_command = pip install -U --force-reinstall {opts} {packages}
 commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
 [testenv:genconfig]