downgrade os_str_bytes to v6.3.1 in b3sum/Cargo.lock

v6.4.0 has a bug where invalid UTF-16 filenames fail a debug_assert on
Windows. See dylni/os_str_bytes#14. The vast
majority of b3sum users should be running a binary built in release mode
and shouldn't be affected by this. This lockfile change fixes our CI,
but note that `cargo install` doesn't respect lockfiles by default
(without --locked), so anyone running a debug binary against invalid
Windows filepaths (very rare) will still need to wait for an upstream
patch release.