Lock rebar.config to some static commits

in preparation of release
Remove bson dep, as it's brought in by mongo
Use CB fork of erlando for update-deps