Revert "Revert "chore: update deps""

[mikewilli]

Reverts #3295

The original change was reverted to give time to discuss the intended behavior for exposures because this change makes the default behavior different. The decision was made to go ahead with this change, as it should give us more precise information about the exposed clients, without losing anything about the current system (i.e., the enrollment and observation periods can be treated the same way).

Previous:

• telemetry for exposed clients is filtered based on the window start/end offset from enrollment_date
• clients are only considered "exposed" if the exposure event occurs during the enrollment period (by default, this is configurable)

After this change:

• (different) telemetry for exposed clients is filtered based on the window start/end offset from exposure_date
• (same) clients are only considered "exposed" if the exposure event occurs during the enrollment period (by default, this is configurable)

cc @danielkberry@irrationalagent -- this PR incorporates the bug fix from mozanalysis as we discussed