CI solves all dependencies at published bounds without the network-arbitrary allow-newer stopgap

[alunduil]

Summary

Remove the --allow-newer=network-arbitrary:base,network-arbitrary:QuickCheck
stopgap from ci.yml once a network-arbitrary release lifts its base and
QuickCheck caps, so CI once again solves every dependency at its published bounds.

Motivation

ci.yml threads that flag through six steps (lines 64, 78, 89, 93, 101, and
126), documented at ci.yml:46-51: network-arbitrary caps base < 4.21, which
excludes GHC 9.12 and 9.14, and lags QuickCheck. Without the relaxation the
matrix can't build its test suite on the newer compilers.

The scoping is careful — it names one package and two of its dependencies, so the
library's own published bounds stay strictly enforced and the sdist-based build
still tests what a consumer faces. The residual gap is narrow but real: the test
suite builds against a resolution no downstream user would get, so a genuine
incompatibility in network-arbitrary on 9.12/9.14 is invisible here.

This is bookkeeping against an upstream release, in the same shape as #142
(aeson/network-uri-json), which closed the same way.

Scope

• Watch Support GHC 9.12 and 9.14 (base 4.21 / 4.22) network-arbitrary#106 for a release lifting the caps.
• Bump the network-arbitrary bound in collection-json.cabal if needed.
• Delete the --allow-newer flag from all six ci.yml steps and the explanatory
  comment at ci.yml:46-51.

Acceptance criteria

• No allow-newer remains in ci.yml.
• The full GHC matrix is green with every dependency solved at published bounds.

Additional context

• Upstream: Support GHC 9.12 and 9.14 (base 4.21 / 4.22) network-arbitrary#106.
• Same pattern as Unpin aeson once network-uri-json#95 ships #142.