Bump tinycss2 dependency upper pin

See https://github.com/Kozea/WeasyPrint/issues/2657 - newer versions of weasyprint require a newer `tinycss2` version, but currently bleach pins an older version.

Similar previous issue: #732