[pkg] Set an upper bound to passlib
We're using a deprecated API and are getting the following deprecation
warning:
::
the method passlib.context.CryptContext.encrypt() is deprecated as of
Passlib 1.7, and will be removed in Passlib 2.0, use CryptContext.hash()
instead.
So let's make sure we're getting a working library.
[ci skip]