ensure-virtualenv: call ensure-pip for Xenial

As described inline, we need a fresher pip to make virtualenv work on
Xenial.

Change-Id: I2187d18fec938c4b94e16f1d6631ea743d9325f9

roles/ensure-virtualenv/tasks/Debian.yaml

@@ -1,3 +1,14 @@
+# The pip that comes with Xenial (v8) does not understand how to
+# fallback to pypi in the OpenDev mirror setup.  The virtualenv
+# package tries to use the system pip to bootstrap the environment it
+# creates, and thus the xenial packaged virtualenv can not create a
+# working environment.  We pre-run ensure-pip there to bring in our
+# backported pip9 and make this work.
+- name: ensure-pip for Xenial
+  include_role:
+    name: ensure-pip
+  when: ansible_distribution_release == 'xenial'
+
 - name: Install virtualenv
   package:
     name: