Lock CI workflows to tox<4

Tox 4 was released last month, and has since released 23 patch
releases. All of them break compatibility with our tox.ini in two
important regards:

`passenv` is no longer a space separated glob list, it seem it needs to
be a comma-separated one.

More importantly, tox no longer interprets quotes in commands - it
interprets them literally and feeds them as verbatim arguments to the
called commands, causing every command in our tox.ini file that uses
quotes to fail.

.github/workflows/build-and-test.yml

@@ -51,7 +51,7 @@ jobs:
       - name: "Install test runner dependencies"
         run: |
           set -xe
-          python -m pip install --upgrade pip setuptools wheel tox tox-gh-actions coverage virtualenv snmpsim
+          python -m pip install --upgrade pip setuptools wheel 'tox<4' tox-gh-actions coverage virtualenv snmpsim
           sudo apt-get install -y nbtscan
 
       # virtualenv seems to currently be embedding a broken version of