Bump aeson upper bound.
Text.Pandoc.SelfContained changes.

* mkSelfContained now takes just two arguments, WriterOptions and
  the string.
* It no longer looks in data files.  This only made sense when we
  had copies of slidy and S5 code there.
* Shared.fetchItem' is used instead of the nearly duplicate getItem.
Shared: fetchItem improvements.

* More consistent logic:  absolute URIs are fetched from the net;
  other things are treated as relative URIs if sourceURL is a Just,
  otherwise as file paths.
* We escape characters that are not allowed in URIs before trying
  to parse them (e.g. '|', which often occurs in the wild).
* When treating relative paths as local file paths, we drop
  any fragment or query.  This is useful e.g. when you've downloaded
  web fonts locally, but your source still contains the original
  relative URLs.

Together with the previous commit, this should close #1477.