setup: pin rspack

[utnapischtim]

• rspack >=1.7.0 introduced that 'this' in a closure will compile to an
  undefined value. so code which uses a callback and uses something like
  'this.props' in the function body will stop working.

• the code should work as the javascript specs and tests show that the
  code should be correct so rspack introduced a bug with 1.7.0.

• until now pinning to <1.7.0 is the fasted way to fix it.

[utnapischtim]

related to inveniosoftware/invenio-administration#273 . in PR in invenio-administration was not necessary for rspack >= 1.7.0, but it is still a valid addition because of a linter warning of destructuring this.props assignment.

nevertheless another "bug" showed up here where this is undefined in a arrow callback.

it has to be evaluated if we have a bad situation in invenio or if rspack introduced a bug. at the moment it looks like rspack introduced a bug with >= 1.7.0

[mesemus]

lgtm, locally we have this but it captures the same range

    "@rspack/cli": "~1.6.8",
    "@rspack/core": "~1.6.8",
    "@rspack/dev-server": "~1.1.5",

[max-moser]

just did a quick test, and i could reproduce both the problem (with rspack v1.7.1) as well as the fix.

for the record, the full build process ran through in both cases; the issue is actually a runtime problem.
namely, with the latest version of rspack, the (legacy, not uppy) file uploader on the deposit form would fail at 0% progress due to some JS error(s).