cabal: Add upper version bounds