Explicitly pin guava and cassandra-thrift to ensure clients use correct ...

...version