unpin tox in requirements

for some reason bandit wasn't earlier catching the SubElement usage but
now it is, but it's harmless anyway so we'll just suppress it.

Signed-off-by: Brian S. Stephan <bss@incorporeal.org>

requirements/requirements-dev.txt

@@ -10,8 +10,12 @@ blinker==1.7.0
     # via flask
 build==1.0.3
     # via pip-tools
+cachetools==5.3.2
+    # via tox
 certifi==2023.11.17
     # via requests
+chardet==5.2.0
+    # via tox
 charset-normalizer==3.3.2
     # via requests
 click==8.1.7
@@ -19,6 +23,8 @@ click==8.1.7
     #   flask
     #   pip-tools
     #   safety
+colorama==0.4.6
+    # via tox
 coverage[toml]==7.4.0
     # via
     #   coverage
@@ -97,6 +103,7 @@ packaging==21.3
     # via
     #   build
     #   dparse
+    #   pyproject-api
     #   pytest
     #   safety
     #   setuptools-scm
@@ -106,13 +113,13 @@ pbr==6.0.0
 pip-tools==7.3.0
     # via incorporeal-cms (pyproject.toml)
 platformdirs==4.1.0
-    # via virtualenv
+    # via
+    #   tox
+    #   virtualenv
 pluggy==1.3.0
     # via
     #   pytest
     #   tox
-py==1.11.0
-    # via tox
 pycodestyle==2.11.1
     # via flake8
 pydocstyle==6.3.0
@@ -127,6 +134,8 @@ pyparsing==3.1.1
     # via
     #   packaging
     #   pydot
+pyproject-api==1.5.0
+    # via tox
 pyproject-hooks==1.0.0
     # via build
 pytest==7.4.3
@@ -149,15 +158,13 @@ safety==2.3.5
     # via incorporeal-cms (pyproject.toml)
 setuptools-scm==8.0.4
     # via incorporeal-cms (pyproject.toml)
-six==1.16.0
-    # via tox
 smmap==5.0.1
     # via gitdb
 snowballstemmer==2.2.0
     # via pydocstyle
 stevedore==5.1.0
     # via bandit
-tox==3.28.0
+tox==4.0.0
     # via incorporeal-cms (pyproject.toml)
 typing-extensions==4.9.0
     # via