Switch tox to use allowlist_externals

The whitelist_externals option in tox in deprecated in favor of
allowlist_externals. Update this and also bump our tox minversion to
the earliest version which supports this new syntax. While we're at
it, update a few code comments about bandit "nosec" exceptions to
refer to allowing instead of whitelisting.