Add version pin for plone.app.portlets

Since Plone 5 will have auto csrf protection the schema changes are
not backwards compatible and > 3.0 changes the navigation root storage
to a UID instead of a naive path