[dist] pin python-yum and createrepo release exactly