Lock down some crate versions; update others semver compatibly

In order to be able to build successfully without the lockfile, which
happens when verifying with `cargo package` since package never includes
`Cargo.lock` [1].

If we don't constrain these crates' versions, they update to
incompatible versions of, most problematically, serde_json.

openssl has also deprecated the `finish` method and changed some types
in a minor version bump.

[1] - rust-lang/cargo#2263