Change-Id: I0f14cbaefe3ce786e97475c24a9d2a9db93b8a86

Update the URL to the upper-constraints file to point to the redirect
rule on releases.openstack.org so that anyone working on this branch
will switch to the correct upper-constraints list automatically when
the requirements repository branches.

Until the requirements repository has as stable/2025.1 branch, tests will
continue to use the upper-constraints list on master.

Change-Id: I1c2881769df43a16746917dc70b74281a5ba04ef

This copies a fix from the Watcher project to support pip 23.1:

https://review.opendev.org/c/openstack/watcher/+/948438

Conflicts:
    devstack/lib/barbican

NOTE(melwitt): The conflict is because change
Ia12dc16c0afe4b7000c02e59031259dafe8c8c43 (Generate SimpleCryptoPlugin
KEK for devstack) is not in 2025.1 (Epoxy). The difference from the
cherry picked change is to leave Python 3.9 in the setup.cfg because
Python 3.9 is supported in 2025.1 (Epoxy).

Closes-Bug: #2109584

The following commit is squashed into this one because it is needed for
the openstack-tox-cover CI job to pass:

Exclude barbican/wsgi/api.py from coverage

The WSGI application entry-point for Barbican API isn't really suitable
for unit testing, so exclude it from code coverage measurement.

Related-Bug: #2109584

Change-Id: I07eff3fb73c20f7d29eb7b928b93e7897a4012f5

Change-Id: I91cd5e262513b5427377ce1892e9acfe29e22b21
(cherry picked from commit d98891f)