Lock dependency versions

Works around https://github.com/rodjek/librarian-puppet/pull/94