S-6108 [Can't upload to hackage because of missing upper bounds]

```
Error: [S-6108]
unhandled status code: 400
Upload failed on password-3.0.2.1.tar.gz
"Error: Invalid package\n\nThe dependency 'setup-depends: 'Cabal' does not specify an upper bound on the version number. Each major release of the 'Cabal' package changes the API in various ways and most packages will need some changes to compile with it. If you are not sure what upper bound to use then use the next major version.\n"
```

Tried to `stack upload` the [`password`](https://hackage.haskell.org/package/password) package just now, and `stack` was blocking me from doing so, because the `custom-setup` stanza's `setup-depends` entries didn't have upper bounds.

So I've added `<4` to `Cabal`, and `<5` to `base`, and then it did work.