update python dep to avoid security vuln

[cmharlow]

Refractr PR Checklist

JIRA ticket: came up in context of https://mozilla-hub.atlassian.net/browse/SE-2688

All this PR does is update 1 python package - aiohttp - to handle a minor dependabot-noted security vulnerability.

Have tested it locally with doit workflow & looks fine.

[floatingatoll]

I freely admit my confusion about how this ever worked with .post0 there, but certainly this change is structurally appropriate.

[cmharlow]

Notes for the change, which is technically a rollback of the aiohttp package (but one that makes Dependabot happy).

See https://pypi.org/project/aiohttp/#history & aio-libs/aiohttp#5366

Looks like the .post0 addition to the latest stable release is just a packaging fix & not anything to do with the security issue.

[floatingatoll]

Okay, we looked into this further, and 3.7.4.post0 is newer than 3.7.4 — it's a packaging fix for a third-party dependency. We should stay at .post0. I can still r+ if that's best, but I would prefer to tell Dependabot "no you're wrong" and leave it here.