Pin dune version to fix CI
dune 3.21 reintroduces a bug where dune can't interpret
`pkg-self:npm-version` in reason-react's dune.lock entry, something to
do with opam-check-npm-deps maybe.
should give upgrading another try when we go to ocaml 5.4 (currently
blocked on ppx_rapper)