Relax dependency pinning from patch to minor level only

[alerque]

This is a parallel to harfbuzz/rustybuzz#153 and comments should probably be pursued there.

The only differences are:

• This crate has very few and relatively slow moving depnedencies, so it is less of an issue.
• This project doesn't track a lock file (yet). We could certainly start doing there is a need to do so, but it could factor in to regression testing when not having patch-level pinned dependencies in the manifest.