Pin hacking <0.6

* tox.ini: Newer hacking fails to recognize the Apache header in the
git-review script, so pin at <0.6 for now to match an upcoming
refactoring change. This will allow us to get some quick cosmetic
fixes in first.

Change-Id: I8e92b1d23d0b8d87e3bafe43d97c987abdf1d9f8