Pin `serde_json` in CI to fix MSRV