Use framework BoM for dependencies

blocked on daisy/pipeline-framework#51