Pin zeroize dependency to v1.3 and subtle to v2.4

[newpavlov]

zeroize in v1.4 has updated its MSRV to 1.51 breaking our MSRV promise. This PR pins its version to v1.3.x. subtle is also preemptively pinned to v2.4.

[codecov-commenter]

Codecov Report

Merging #349 (eb84b7d) into master (3a2d1dc) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #349   +/-   ##
=======================================
  Coverage   89.40%   89.40%           
=======================================
  Files          42       42           
  Lines        2020     2020           
=======================================
  Hits         1806     1806           
  Misses        214      214           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3a2d1dc...eb84b7d. Read the comment docs.

[newpavlov]

@tarcieri
Assuming you don't have objections, I can prepare PRs for other affected repositories.

[tarcieri]

@newpavlov sure, sounds good.

Just note that https://github.com/rustcrypto/elliptic-curves is MSRV 1.51 across the board and doesn't need it.

[newpavlov]

The problem is that you may one day bump MSRV for zeroize v1.5, which would break MSRV build for the elliptic curve crates as well. So to be safe I think it's worth to pin 3rd party dependency versions for them as well.

[tarcieri]

Yeah sure, it's OK to pin, just make sure to pin it to 1.4 instead of 1.3 for elliptic-curves.