Update tox.ini for Django 3.2, pypy, github actions

[jwhitlock]

This PR specifies how to install Django 3.2. Before this change, when a test is supposed to run against Django 3.2, it instead runs against the latest release.

This PR adds basepython entries for pypy. This fixes running these test locally.

This PR fixes cpython version mapping in [gh-actions] (like 3.8, 3.9, etc.). Previously, the github action tests for cpython versions were running against the latest Django, instead of all possible Django versions.

This PR drops testing pypy against Django 3.2. There are a few errors that appear:

_____________________________________________ test_report_percentage_report_only _____________________________________________
csp/tests/test_contrib.py:33: in test_report_percentage_report_only
    if "report-uri" in response[HEADER_REPORT_ONLY]:
.tox/pypy38-3.2.x/lib/pypy3.8/site-packages/django/http/response.py:178: in __getitem__
    return self.headers[header]
.tox/pypy38-3.2.x/lib/pypy3.8/site-packages/django/utils/datastructures.py:316: in __getitem__
    return self._store[key.lower()][1]
E   KeyError: 'content-security-policy-report-only'
______________________________________________________ test_csp_update _______________________________________________________
csp/tests/test_decorators.py:58: in test_csp_update
    assert policy_list == ["default-src 'self'", f"img-src foo.com bar.com 'nonce-{request.csp_nonce}'"]
E   assert ["default-src...report-uri x'] == ["default-src...OlDPT/I0w=='"]
E     
E     At index 1 diff: "img-src bar.com 'nonce-RTVrw2N3wZNaaOlDPT/I0w=='" != "img-src foo.com bar.com 'nonce-RTVrw2N3wZNaaOlDPT/I0w=='"
E     Left contains one more item: 'report-uri x'
E     
E     Full diff:
E       [
E           "default-src 'self'",...
E     
E     ...Full output truncated (5 lines hidden), use '-vv' to show
______________________________________________________ test_csp_replace ______________________________________________________
csp/tests/test_decorators.py:122: in test_csp_replace
    assert policy_list == ["default-src 'self'", "img-src bar.com"]
E   assert ["default-src...report-uri x'] == ["default-src...-src bar.com']
E     
E     Left contains one more item: 'report-uri x'
E     
E     Full diff:
E       [
E           "default-src 'self'",
E           'img-src bar.com',
E     +     'report-uri x',
E       ]

This appears to be issue with pypy dictionary implementations. Sometimes the header doesn't appear, and sometimes a dictionary value is retained across tests. Rather than debug this, I decided to drop them for this Django version that is no longer supported.

[jwhitlock]

I was able to get this working in a branch where I added typing annotations. I'll see if I can uplift that fix to this PR.

[jwhitlock]

I haven't figured out the changes that made these work yet. It seems unlikely that pypy changes behavior based on types, so I'll work to tease apart the code changes from the typing changes and see if that fixes it.

I think this PR is still mergable because of the improvement in the testing configuration.

[jwhitlock]

Closing in favor of PR #228