Pin flask version

[carrascomj]

Flask started requiring Jinja2>=3 on pallets/flask@5bd959f#diff-60f61ab7a8d1910d86d9fda2261620314edcae5894d5aaa236b821c7256badd7 and escher (on cameo from modeling-base) depends on Jinja2<3.

If rebuilt, this causes building modeling-base to fail.