Bump lens, random upper version bounds

Allow `vty` to use the latest versions of `lens` (4.5) and `random` (1.1).