OSA: Remove CentOS-7 support for stable/newton

Maintaining CentOS-7 support for Newton when it is unusable
for an integrated build is causing a lot of code churn. We
only want to run CentOS-7 tests for Newton for the security
repository.

Change-Id: Icc00e41286d226dcf89c84cee4490bbaf6c3b86d

zuul/layout.yaml

@@ -3336,9 +3336,10 @@ jobs:
   - name: ^gate-openstack-ansible.*-(docs|linters).*-ubuntu-trusty.*$
     branch: ^stable/mitaka$
 
-  # Keep in mind that stable/mitaka is trusty only, remove centos-7 jobs.
+  # Keep in mind that stable/mitaka and stable/newton are ubuntu only,
+  # so we remove centos-7 jobs.
   - name: ^gate-openstack-ansible-.*-ansible-.*-centos-7.*$
-    branch: ^(?!(stable/mitaka)).*$
+    branch: ^(?!stable/(mitaka|newton)).*$
 
   # Now some specific conditions for openstack-ansible:
 
@@ -3355,6 +3356,11 @@ jobs:
   - name: ^gate-openstack-ansible-openstack-ansible-aio-ubuntu-xenial-nv$
     branch: ^stable/newton$
 
+  # Run the openstack-ansible-security functional test on centos-7
+  # for any branch after stable/mitaka.
+  - name: ^gate-openstack-ansible-security-ansible-func-centos-7.*$
+    branch: ^(?!stable/mitaka).*$
+
   # Skip the OpenStack-Ansible voting aio scenario job on xenial for the
   # openstack-ansible repository if the branch is anything before ocata.
   - name: ^gate-openstack-ansible-openstack-ansible-aio-ubuntu-xenial$
@@ -3389,11 +3395,6 @@ jobs:
   - name: ^gate-openstack-ansible-.*-ansible-upgrade.*$
     branch: ^(?!stable/(mitaka|newton)).*$
 
-  # Skip any OpenStack-Ansible jobs for os_ repositories which run on CentOS7
-  # except os_keystone, os_glance, os_cinder for stable/newton.
-  - name: ^gate-openstack-ansible-os_(?!(keystone|glance|cinder)).*-ansible-.*-centos-7.*$
-    branch: ^(?!stable/(mitaka|newton)).*$
-
   # Skip any deploy guide publish jobs for mitaka
   - name: ^gate-openstack-ansible-deploy-guide$
     branch: ^(?!stable/mitaka).*$