Pin vuls to a stable release instead of using the master branch

bluval currently uses the vuls master branch, which might break if upstream makes changes that are not backwards compatible.

Instead, we should pin vuls to a stable version.