deps-frozen: fix flask-mail version (used by tox & jenkins)