Apply global-pins as constraints to ensure complete pinning

The current pinning method for pip/setuptools/wheel works for the
initial setup of a host or python venv. However, when a python
package which has one of these in its requirements is installed
onto the host or into the venv and the '--upgrade' option is given
to pip, the package will be upgraded to the latest version available
within the given constraints.

As OpenStack's requirements management process does not cater for
the pip, setuptools or wheel packages we need to ensure that all
python install tasks prior to the repo being built use our global
pins as a constraint in addition to the OpenStack uppser constraints.

As pip's --constraints option can only take a file as an argument
we have to copy the global pins file to the target which will use
it. This file can be removed from the host once the repo is built.

Related-Bug: #1658773
Closes-Bug: #1658948
Change-Id: Iccbb2e4a126a1cc7a4c94ab41b7ce8ef54d89990
(cherry picked from commit 253ea10d26)

releasenotes/notes/issue-ansible-bootstrap-pins-637af623a1d5aef4.yaml

@@ -0,0 +1,6 @@
+---
+issues:
+  - The bootstrap-ansible script may fail with an incompatible requirement
+    when installing OpenStack-Ansible 13.3.12 and before. See
+    https://bugs.launchpad.net/openstack-ansible/+bug/1658948 for more
+    details.

scripts/bootstrap-ansible.sh

@@ -103,7 +103,7 @@ if [ -f "requirements.txt" ];then
 fi
 
 # Install ansible
-PIP_OPTS+=" --constraint ${UPPER_CONSTRAINTS_FILE}"
+PIP_OPTS+=" --constraint global-requirement-pins.txt --constraint ${UPPER_CONSTRAINTS_FILE}"
 
 # When upgrading there will already be a pip.conf file locking pip down to the repo server, in such cases it may be
 # necessary to use --isolated because the repo server does not meet the specified requirements.