update deps

Cargo.lock refers to a yanked version of quick-xml, so let's bump everything.

• ron changelog: https://github.com/ron-rs/ron/blob/master/CHANGELOG.md (0.7 -> 0.8)
• quick-xml changelog: https://github.com/tafia/quick-xml/blob/master/Changelog.md (0.23.0 -> 0.25.0)