fix: lock cbor_serialization to 0.4.0, matching what resolves

The lock pinned 0.3.0, but `nimble setup` installs 0.4.0 every time --
verified from a clean nimbledeps, so it is deterministic, not flaky:
brokers requires cbor_serialization >= 0.3.0 and nimble takes the newest
that satisfies it. The lock was simply describing a version nobody uses.

0.4.0 builds and the whole Rust suite passes on it (as every run in this
branch already did). This makes the lock state reality.

The real over-pin is upstream: nim-ffi's ffi.nimble requires
`cbor_serialization == 0.3.0`, which nimble ignores here but which should
become `>= 0.3.0` in nim-ffi so the graph is honestly consistent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nimble.lock

@@ -264,18 +264,20 @@
       }
     },
     "cbor_serialization": {
-      "version": "0.3.0",
-      "vcsRevision": "1664160e04d153573373afddc552b9cbf6fbe4dc",
+      "version": "0.4.0",
+      "vcsRevision": "bd367543e89929570c2c40cc760588b96d988815",
       "url": "https://github.com/vacp2p/nim-cbor-serialization",
       "downloadMethod": "git",
       "dependencies": [
         "nim",
         "serialization",
         "stew",
-        "results"
+        "npeg",
+        "results",
+        "unittest2"
       ],
       "checksums": {
-        "sha1": "ab126eae09a6e39c72972a6a0b83cb06a2ffe8f0"
+        "sha1": "718496359dd4f45fcf105264c3c03b961b4a5ada"
       }
     },
     "json_serialization": {