Fix cargo audit issue on criterion (#1923)

* Depend on criterion 0.4.0

This updates criterion from 0.3.6 to 0.4.0 to avoid RUSTSEC-2021-0127
where criterion 0.3.6 depends upon an unmaintained crate `serde_cbor`.

* Update CHANGELOG.next.toml

Co-authored-by: Saito <awsaito@c889f3b5ddc4.ant.amazon.com>