deps: pin serde to 1.0.220 to keep reflow_js compiling

serde 1.0.228 dropped the `__private` re-exports that
swc_common 0.33.26 / swc_config 0.1.15 reach into. reflow_js
transitively depends on both via swc_ecma_transforms_typescript,
so cargo check on the workspace fails with "unresolved import
serde::__private" until those crates land their own bumps.

1.0.220 is the floor (axum 0.7's serde_path_to_error 0.1.20 needs
>= 1.0.220) and is the last release before the swc breakage. Hold
there until reflow_js can move to a swc that doesn't poke at
serde internals.

Author: darmie