Update the Static SDK for Linux

[al45tair]

Updated the versions of:

• libxml2 (2.14.5)
• curl (8.15.0)
• BoringSSL (newer SHA)

and added:

• bzip2 (1.0.8)
• xz-utils (5.8.1)
• libarchive (3.8.1)
• mimalloc (2.2.4)

Plus two security patches for musl to fix CVE-2025-26519.

Also link mimalloc by default, so programs using the Static SDK for Linux get a better memory allocator out of the box.

rdar://156423711

[al45tair]

This will require updates to the Static SDK build job, because it changes the versions of dependencies and adds some dependencies. Also, we will need to check the licensing situation before merging this.

[al45tair]

Ideally we should land swiftlang/swift#84705 and swiftlang/swift#84706 first, as that will mean that all builds of the 0.1.0 version of the Static SDK for Linux will have library evolution disabled. That seems cleaner than landing this one first.

[marcprux]

Tangential to this PR, but I'd like to align Android's dependencies with these. A few questions:

• Any particular reason for the specific BORINGSSL_VERSION=817ab07ebb53da35afea409ab9328f578492832d?
• Is the addition of the bzip2, libarchive, mimalloc, and xz dependencies somehow related to the version bumps for boringssl, libcurl, or libxml2?

[al45tair]

Any particular reason for the specific BORINGSSL_VERSION=817ab07ebb53da35afea409ab9328f578492832d?

Yes. I chose the hash Swift NIO is currently using. The problem with BoringSSL is that it doesn't actually have proper releases; the BoringSSL maintainers actively talk to the NIO maintainers and that's how they get the hash to use. We should ideally pick up the same hash whenever they change it (it might be better to just check out the NIO repository to get the version we need, but that's not a change I've made here).

Is the addition of the bzip2, libarchive, mimalloc, and xz dependencies somehow related to the version bumps for boringssl, libcurl, or libxml2?

No. Those were requests that I had from various parties: mimalloc because the Musl memory allocator is poor; bzip2, libarchive and xz because some folks wanted to use those compression libraries and I thought it made sense to make them part of the SDK itself, given how prevalent their use is.