CI: constrain deps for tests

Previously, we ran unconstrained so we could piggy-back off our extras,
but it causes issues in stable gates.

Change-Id: I5b04a1e4d6fb46cdcd50b547aa52290b8bf022ab

test-requirements.txt

@@ -1,6 +1,7 @@
 hacking>=3.2.0,<3.3.0 # Apache-2.0
 
 coverage!=4.4,>=4.0   # Apache-2.0
+python-keystoneclient>=0.7.0
 keystoneauth1>=3.4.0  # Apache-2.0
 stestr>=2.0.0,!=3.0.0 # Apache-2.0
 openstacksdk>=0.11.0  # Apache-2.0

tox.ini

@@ -1,18 +1,18 @@
 [tox]
 envlist = py3,pep8
 minversion = 3.18.0
-skipsdist = True
 
 [testenv]
+skipsdist = True
 usedevelop = True
 list_dependencies_command = python -m pip freeze
 setenv =
   LANG=en_US.utf-8
   VIRTUAL_ENV={envdir}
 
-deps = -r{toxinidir}/requirements.txt
+deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
+       -r{toxinidir}/requirements.txt
        -r{toxinidir}/test-requirements.txt
-       .[keystone]
 commands = sh -c '(find . -not \( -type d -name .?\* -prune \) \
            \( -type d -name "__pycache__" -or -type f -name "*.py[co]" \) \
            -print0) | xargs -0 rm -rf'
@@ -87,8 +87,7 @@ commands = bindep test
 
 [testenv:releasenotes]
 usedevelop = False
-deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master}
-       -r{toxinidir}/doc/requirements.txt
+deps = {[testenv:docs]deps}
 commands = sphinx-build -a -W -E -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
 
 [testenv:pdf-docs]