Update bounds/hadrian to fix bootstrapping with 9.0.

This fixes #19484. In detail we:

* Bump the index-state of hackage.
* Require alex-3.2.6, as alex-3.2.5 doesn't build with 9.0.
* Allow Cabal-3.4 as 3.2 doesn't build with ghc 9.0.
* Allow a newer QuickCheck version that accepts the new base version.
* Some code changes to account for Cabal changes.