The tox-based jobs that run on CircleCI don't hold their dependencies fixed

[exarkun]

For some jobs run on CircleCI, we build Docker images that have a snapshot of dependencies pre-installed. However, when it comes time to create the virtualenv, we don't force pip to limit itself to the contents of the Docker image.

There is a comment saying this is to support installing development versions of dependencies for "upcoming-deprecations". However, we no longer run such a job on our CI so we can stop pip from using an index now and make it use only the dependencies in the image.

This will increase build reproducibility.

[GitHub <noreply@…>]

In 4edf98b/trunk:

Merge pull request #1295 from exarkun/restrict-ci-to-wheelhouse

Restrict ci to wheelhouse

Fixes ticket:4019
Fixes ticket:4020