fix(core): pin winnow dependency to 0.4.1 to keep 1.60 MSRV

[lucasfernog]

What kind of change does this PR introduce?

• Bugfix
• Feature
• Docs
• New Binding issue #___
• Code style update
• Refactor
• Build-related changes
• Other, please describe:

Does this PR introduce a breaking change?

• Yes, and the changes were approved in issue #___
• No

Checklist

• When resolving issues, they are referenced in the PR's title (e.g fix: remove a typo, closes #___, #___)
• A change file is added if any packages will require a version bump due to this PR per the instructions in the readme.
• I have added a convincing reason for adding this feature, if necessary

Other information

[epage]

FYI for lib crates using = can break people if they are also using the crate.

Examples:

• Cargo is unable to resolve dependency versions rust-lang/cargo#6584 (comment)
• https://www.reddit.com/r/rust/comments/p8clcx/how_to_fix_cargo_dependency_issue/

Generally, unless a crate is a [[bin]] or will only be used by a [[bin]], you should rely on Cargo.lock for resolving MSRV problems.

Of course rust-lang/cargo#9930 makes this problem go away and we are working towards it.