Pin thor to prevent accidental upgrades

Thor was upgraded again in #7345, but there are still "warnings" looking
like errors when using "db:migrate" for example. So lets pin it until it is
safe to upgrade.

closes #7351