Lower upper version bounds on sdl2

According to the package versioning policy, the upper two numbers in a package's version are to be incremented on API incompatible changes.

The version constraint on the `sdl2` package is too broad, `helm` may not work with newer versions of `sdl2` in the future. This patch is precautionary.