Add upper bounds to dep versions

[adamjstewart]

Another attempt to make TorchGeo more stable. Assuming that our dependencies follow semver, this PR assures that each TorchGeo release will continue to build for the indefinite future.

For a concrete example of why this PR is necessary, our 0.2.1 release currently doesn't work with the latest version of torchmetrics since 0.9 introduced a backwards-incompatible change (fixed in #555). Our 0.2.0 and older releases also doesn't work with torchmetrics 0.8 due to another backwards-incompatible change (fixed in #361, #382). Since neither release specified an upper bound on the torchmetrics dependency, the simple pip install torchgeo no longer works, you have to manually specify a compatible version of torchmetrics too. In Spack and Conda, we can specify this restriction after the fact, but this isn't possible with pip without a new release.

Caveats:

• This PR assumes our dependencies know about and care enough to follow semver properly. It remains to be seen how closely our dependencies follow semver. Luckily, none of our dependencies use non-semver versioning schemes like dates.
• These upper bounds need to be updated any time a new major release (or minor release for 0.X versions) comes out. We'll see how this interacts with dependabot. For now, I'm following the GitHub release announcements for all of our dependencies, so that should be sufficient to catch these kinds of things.

Closes #544

[adamjstewart]

I don't think it's necessary to do this for our environment.yml file, but we should do it in our Spack and Conda recipes. Will update those during the next release.

[calebrob6]

Why not necessary in environment.yml?

[adamjstewart]

Because environment.yml isn't included in the sdist (*.tar.gz) or bdist (*.whl) in our PyPI releases. This change is really only required to make sure that pip install continues to work, it doesn't affect Conda or Spack in any way. Honestly, I kinda want to get rid of environment.yml. It's only needed because Conda doesn't support installing from main like pip and Spack do.