fix(CI): pin maven cargo version