fix(deps): pin dependency versions in Cargo.toml

[Dazzanova]

Summary

• Pin all dependency versions in Cargo.toml to their exact versions from Cargo.lock.

Problem

• Cargo.toml uses loose dependency versions, which can allow automatic patch updates and cause unexpected issues.

Solution

• Updated all dependencies to use exact =x.y.z versions matching Cargo.lock.

Related

Closes #532

[alejandro-vaz]

thanks for contributing

[jdm]

What is the motivation here? This is an unusual practice.

[alejandro-vaz]

to make sure that dependency requirements don't change between patch versions

it seems that's what happened to criterion that caused #396 to not be able to compile and had to be reverted with #430 before we had to finally get back the PR with criterion 0.4

technically 0.7 would have sufficed, but it seemed a version requiring rustc 1.86+ was published as a patch or something along those lines, so after the 0.7 download (which required 1.80 at publish time) some dep updated it's version of clap_lex that required 1.86 invalidating 1.80 for the published version

[jdm]

I don't think it's it's a good idea to use exact version pinning like this in a library crate, because any crate that includes smallvec anywhere in its dependency tree will no longer be able to independently upgrade (or downgrade) any crate that smallvec depends upon.

[jdm]

Given how common it is for other projects to rely on serde_core and bytes, I think we should revert this change. It's going to confuse and annoy other projects.