ox: constrain version of  async_extra rather than async

That is the package that contains the API incompatibility.