Constrain pylint to supported versions
    
    Two, three times a year PR-CI starts failing because tox tests pull in a
    newer version of pylint with new warnings. To reduce breakage this
    change constraints pylint (and indirectly astroid) to latest tested
    minor version. The constraint should be updated when FreeIPA starts to
    support a new Fedora version with more recent pylint.
    
    Related: https://pagure.io/freeipa/issue/8818
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Stanislav Levin <slev@altlinux.org>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>