Cap bandit below 1.6.0 version and add it into pep8 section

1. Bandit 1.6.0 accidentally changed how to exclusion list option is
handled and breaks our use of it. Cap to the previous version until
bandit has has fixed the problem.
2. add bandit test into pep8
3. clean up envlist

Change-Id: I9c7030e6fab24fb31871042dc15d23eae9fe2161

test-requirements.txt

@@ -6,9 +6,9 @@
 hacking>=1.1.0,<1.2.0
 
 ansible>=2.4.0
-bandit>=0.13.2
+# security linter
+bandit>=1.1.0,<1.6.0 # Apache-2.0
 coverage>=3.6
-discover
 doc8>=0.6.0 # Apache-2.0
 fixtures>=0.3.14
 mock>=1.0

tox.ini

@@ -1,7 +1,7 @@
 [tox]
 minversion = 1.6
 skipsdist = True
-envlist = py37,pep8,mypy,functional,functional-py36,py27
+envlist = py37,pep8,mypy,py27
 
 [testenv]
 usedevelop=True
@@ -50,6 +50,8 @@ deps = {[testenv]deps}
 commands =
   flake8 {posargs}
   doc8 doc/source
+  # Run security linter
+  {[testenv:bandit]commands}
 
 [testenv:mypy]
 basepython = python3
@@ -68,7 +70,8 @@ exclude = .venv,.git,.tox,dist,doc,*lib/python*,*egg,build
 
 [testenv:bandit]
 basepython = python3
-commands = bandit -r kolla_cli
+# Run security linter
+commands = bandit -r kolla_cli -x tests
 
 [testenv:docs]
 basepython = python3