Consider specifying more dependency versions in setup.cfg

[dstaley]

Earlier today, ujson updated to 2.0.0 which broke building on Windows. Since ujson is specified in setup.cfg without a version identifier, it will always install the latest version. We should probably consider specifying versions so that we don't run into scenarios like this. I don't know too much about python packaging, but it looks like we could at least specify a specific major version.

[hugovk]

Generally, although I don't think the majority do it, it's nevertheless fairly common in Python for libraries to specify a max version for dependencies, to avoid surprises with major versions, eg. some_package<5 if we know it currently works with version 4.

Specifically, we hope to have a fixed ujson 2.0.1 out tomorrow for this (and thanks again for the help on that!).