chore: Force transitive dependencies to CVE free versions

[robert3005]

Since those are mostly transitive (or dependabot looks at the lower bound in
case of cargo) we need to manually force the higher version since it might be
a while before our dependencies pick them up

Signed-off-by: Robert Kruszewski [email protected]

[codspeed-hq]

Merging this PR will degrade performance by 33.21%

❌ 1 regressed benchmark
✅ 1137 untouched benchmarks
⏩ 1265 skipped benchmarks¹

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Simulation	chunked_bool_into_canonical[(1000, 10)]	43 µs	64.4 µs	-33.21%

---

_{Comparing rk/bumps (723ff79) with develop (4873dca)}

Footnotes

1. 1265 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩