Build failure of `master` due to `hackage-security-0.6.2`

[andreasabel]

Current master (c84f467) fails to build with GHC 9.2.4 in the latest ecosystem:

src/Distribution/Client/Mirror/Repo/Secure.hs:127:33: error:
    • Couldn't match type ‘PackageIdentifier’
                     with ‘Cabal-syntax-3.8.1.0:Distribution.Types.PackageId.PackageIdentifier’
      Expected: Cabal-syntax-3.8.1.0:Distribution.Types.PackageId.PackageIdentifier
        Actual: PackageId
      NB: ‘Cabal-syntax-3.8.1.0:Distribution.Types.PackageId.PackageIdentifier’
            is defined in ‘Distribution.Types.PackageId’
                in package ‘Cabal-syntax-3.8.1.0’
          ‘PackageIdentifier’
            is defined in ‘Distribution.Types.PackageId’
                in package ‘Cabal-3.6.3.0’
    • In the second argument of ‘Sec.downloadPackage'’, namely ‘pkgId’
     ...
    |
127 |        Sec.downloadPackage' rep pkgId locTgz
    |                                 ^^^^^

cabal-plan shows that Cabal-3.8 enters through hackage-security even though we bound Cabal ^>= 3.6.3.0:

 │   ├─ hackage-security-0.6.2.2
 │   │   ├─ Cabal-syntax-3.8.1.0

Solution: bound hackage-security < 0.6.2

Better solution: add Cabal-syntax as explicit dependency