Whitelist external lazr.authentication requirement

* tox.ini(testenv.install_command): Use the --allow-external and
--allow-insecure options so that pip 1.5 and later will assent to
retrieve the lazr.authentication package even though it's not hosted
on PyPI. The --allow-insecure option is aliased to a clearer
--allow-unverified wording in 1.5, but the old form is being used to
avoid breaking users of 1.4.x and will be valid at least through
1.6.x according to comments in the pip source.

Change-Id: I52342a805a8b0b5ade7de494b1fd9b4079b93263