chore: Future proof release against uproot4 API changes

[matthewfeickert]

Description

As @jpivarski mentioned that uproot4 is going to have some API changes from the uproot v3 releases, require that the version of uproot that is included in the releases until uproot4 is released for broad use is using the uproot v3 API.

Once uproot4 is released and stable this can get changed to using

'xmlio': ['uproot~=4.0']

to ensure that all future releases of pyhf get the uproot4 API.

Checklist Before Requesting Reviewer

• Tests are passing
• "WIP" removed from the title of the pull request
• Selected an Assignee for the PR to be responsible for the log summary

Before Merging

For the PR Assignees:

• Summarize commit messages into a comprehensive review of the PR

* Ensure that the next release series of pyhf isn't broken in the future by API changes in uproot4

[codecov]

Codecov Report

Merging #930 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #930   +/-   ##
=======================================
  Coverage   96.30%   96.30%           
=======================================
  Files          56       56           
  Lines        3191     3191           
  Branches      438      438           
=======================================
  Hits         3073     3073           
  Misses         75       75           
  Partials       43       43           

Flag	Coverage Δ
#unittests	96.30% <ø> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 79984be...e331d3a. Read the comment docs.