metadata: bound dependencies

New requirement for the Puppet Forge.

These ranges ensure dependencies will stay on backwards compatible versions for the foreseeable future.