requirements: pin lxml==4.3.5 for py35 as well

not just py27.

https://travis-ci.org/fonttools/fonttools/jobs/564917367

Maybe the latest lxml is casting the attributes to a built-in dict type,
which only retains the insertion order from 3.6 onwards?