Update pytest-cov version requirement and fix other build failures

[skiedude]

1# pytest-cov fix
While Stackstorm supports python 3.8 (rocky8), pytest-cov needs to be downgraded to 5.0.0. This was updated in #6340

ERROR: Ignored the following versions that require a different python version: 6.0.0 Requires-Python >=3.9; 6.1.0 Requires-Python >=3.9; 6.1.1 Requires-Python >=3.9; 6.2.0 Requires-Python >=3.9; 6.2.1 Requires-Python >=3.9; 6.3.0 Requires-Python >=3.9; 7.0.0 Requires-Python >=3.9
ERROR: Could not find a version that satisfies the requirement pytest-cov>=6.1.1 (from versions: 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, 0.15, 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7.0, 1.8.0, 1.8.1, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.3.1, 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.10.0, 2.10.1, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 3.0.0, 4.0.0, 4.1.0, 5.0.0)

Fresh 3.9 install on Rocky8

# st2 --version
st2 3.9.0, on Python 3.8.17

2# pin DOCKER_API_VERSION
According to https://circleci.com/docs/guides/execution-managed/building-docker-images/ circleci currently supports up to docker24 however installing the latest docker-cli uses an API version that docker24 does not support. Thus we can pin it to 1.43 which is the maximum API version allowed with docker24

3# pin pynacl

[package: st2] [19:16:24]      
[package: st2] [19:16:24]      The conflict is caused by:
[package: st2] [19:16:24]          The user requested cffi==1.17.1
[package: st2] [19:16:24]          cryptography 43.0.3 depends on cffi>=1.12; platform_python_implementation != "PyPy"
[package: st2] [19:16:24]          st2client 3.9.dev0 depends on cffi==1.17.1
[package: st2] [19:16:24]          st2common 3.9.dev0 depends on cffi==1.17.1
[package: st2] [19:16:24]          pynacl 1.6.1 depends on cffi>=2.0.0; platform_python_implementation != "PyPy" and python_version >= "3.9"

The newest version of pynacl (pulled in by paramiko) requires a newer version of cffi than we pin, so pin pynacl at 1.6.0

[nzlosh]

I've re-run the tests that failed and they're all passing. Thank you for fixing this. 👍

[cognifloyd]

I wonder if the GHA workflow to regenerate the lockfile should learn to deal with this file somehow.

This file is not a simple "copy the locked version", so we'd need to be careful to not turn that workflow into a maintenance headache.