Pin aruba to a version that still builds

[chastell]

Aruba is quick to drop backwards compatibility in 0.x releases, and this is why master doesn’t build.

This pins aruba to a version that still works. I’ll come up with fixes to forward-port Bogus later this month, but I’d rather the master was green for the sake of other PRs.