Pin boto3 and botocore to 1.35.99

Starting with 1.36.0[1], boto3 implements a new security feature that
may not be implemented by some S3-compatible storage backends, such as
Ceph RGW. This causes glance_store users to notice failures when
uploading images to such backends[2]. This might also impact other projects
such as Cinder.

Pinning boto3 to 1.35.99 until we come up with a proper workaround for
this. Also pinning botocore to 1.35.99 as this is the only version that
is compatible with boto3 1.35.99, and pinning s3transfer to 0.10.0 as
this is the only version that is compatible with botocore 1.35.99.

(tonyb) As this is potentially a longer term issue, include the caps
in global-requirements.txt to ease constraints updates.

[1] https: //github.com/boto/boto3/blob/dd74a1e97c450cf7670cabf3a9516b5127bcffb5/CHANGELOG.rst#L1882
[2] https://bugs.launchpad.net/glance/+bug/2121144

Change-Id: I311a74d6839410779f89f3bde817c221d9d8344e
Signed-off-by: Cyril Roelandt <cyril@redhat.com>
Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>

Author: CyrilRoelandteNovance

global-requirements.txt

@@ -24,8 +24,11 @@ bcrypt==4.0.1  # Apache-2.0
 beautifulsoup4  # MIT
 betamax  # Apache-2.0
 boto  # MIT
-boto3  # Apache-2.0
-botocore  # Apache-2.0
+# Capped until https://bugs.launchpad.net/glance/+bug/2121144 is resolved
+boto3<1.36  # Apache-2.0
+botocore<1.36  # Apache-2.0
+# indirect from boto3/botocore
+s3transfer<0.11  # Apache-2.0
 cachetools  # MIT License
 cassandra-driver!=3.6.0  # Apache-2.0
 cffi  # MIT

upper-constraints.txt

@@ -315,7 +315,7 @@ retrying===1.4.1
 XStatic-Dagre===0.6.4.1
 platformdirs===4.3.8
 pydotplus===2.0.2
-boto3===1.40.1
+boto3===1.35.99
 jeepney===0.9.0
 stestr===4.2.0
 pillow===11.3.0
@@ -328,7 +328,7 @@ aiomysql===0.2.0
 types-simplejson===3.20.0.20250326
 sphinxcontrib-httpdomain===1.8.1
 metalsmith===2.5.0
-s3transfer===0.13.1
+s3transfer===0.10.0
 text-unidecode===1.3
 sphinxcontrib-svg2pdfconverter===1.3.0
 oslo.vmware===4.7.0
@@ -445,7 +445,7 @@ tomli===2.2.1;python_version=='3.9'
 oslo.upgradecheck===2.6.0
 sherlock===0.4.1
 stevedore===5.5.0
-botocore===1.40.1
+botocore===1.35.99
 xmltodict===0.14.2
 pyasn1===0.6.0
 oslo.rootwrap===7.7.0