chore: restrict rsa version to <=4.0 for Python 2.7 compatibility

[plamut]

Fixes#134.

This PR assures that too new a version of the rsa dependency does not break the library's Python 2.7 compatibility.

That version is already two years old, though, and it represents a yet another reason to start dropping Python 2.7 (and 3.5) support, too.

PR checklist

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

[plamut]

AttributeError: module 'virtualenv.activation.python' has no attribute 'PestythonActivator'

I'm not sure what that is, happens when commands in virtualenvs are run, hopefully a restart will make the CI checks green again.

[shollyman]

Thanks, Peter!

[shollyman]

bad day for python releases. looks like the new breakage here is in virtualenv

[HemangChothani]

@plamut This issue has been handled in google-auth library as you can see here, is this change still needed.

[plamut]

@HemangChothani Thanks for the update!

In theory the change should not be needed, just a version bump of the auth library, but I'm not 100% sure pip resolves always determines the matching versions correctly (the resolver is currently being rewritten AFAIK).

I would thus play it safe and be explicit about this, but I will borrow the fix from auth, which only restricts the RSA version for Python 2, while keeping it up to date in Python 3.