make CI jobs faster, and other improvements

[vszakats]

After this patch BuildFuzzers and Testi386 jobs need about 7.5 minutes
per job, down from 15-16m, for a >2x speed-up. There should noticeable
improvements in the other jobs, too:

• Mainline (address): 4m45s → 3m30s (gain: 1m15s)
• Mainline (memory): 2m45s → 2m0s (gain: 45s)
• JustDependencies: 2m → 1m50s (gain: 10s)

Before: https://github.com/curl/curl/actions/runs/16769657727
After: https://github.com/curl/curl-fuzzer/actions/runs/16775268062?pr=181

Also reduce log noise and fix minor issues found along the way. Add
Ninja support.

Details:

• drop progress bar in apt commands.
• CI: move env: before run: to match control flow. (style)
• CI and scripts/ossfuzzdeps.sh: install ninja. For more robust build
  performance across platforms, and more readable logs.
• cmake: drop BUILD_COMMAND $(MAKE) and
  INSTALL_COMMAND $(MAKE) install and use the cmake defaults.
  The defaults work with both GNU Make and Ninja generators. This also
  avoids passing a GNU Make macro to the generator, which broke with and
  error when used with Ninja.
  Ref: https://cmake.org/cmake/help/latest/module/ExternalProject.html
• replace one remaining $(MAKE) use with ${MAKE}, and initialize
  the latter from the calling env. This is necessary to keep avoiding
  the super lengthy OpenSSL manual install phase, which needs a custom
  install target (install_sw) unfortunately.
• cmake: hide download progress lines to reduce log noise.
• cmake: specify build byproducts in ExternalProject_Add() commands.
  Necessary for Ninja to figure out what output is generated, to resolve
  them as dependencies.
• replace gzip packages with .tar.xz where available, for smaller
  downloads.
• switch nghttp2 build from autotools to cmake for better performance.
  (esp. better configure performance.)
• drop redundant zlib dependency for nghttp2. (lib-only builds don't use
  it).
• disable unnecessary components in dependencies to save build time. In
  openssl, zstd, nghttp2, libidn2. (e.g. tools, docs, examples, tests.)
• drop redundant option --enable-websockets when building curl.
  It became the default after leaving the experimental status.
• disable dependency tracking in autotools builds for better
  performance.
• fix MAKEFLAGS, which became -j4-j4 during ossfuzz builds.
  This made all builds run without parallelism.
  Also show this env in the log, for visibility.
• switch curl build from autotools to cmake for better performance.
• stop building the unused curl tool to finish builds faster.
• curl: drop redundant DOWNLOAD_EXTRACT_TIMESTAMP option for Git.
• cmake: drop redundant BUILD_IN_SOURCE and SOURCE_SUBDIR
  options.
• restore groff-base. Turns out to be a tiny patch; it's not worth
  the manual workaround.
  Follow-up to d0bf19b
• remove exec attribute from a C++ source.
• ossfuzz: drop redundant MAKEFLAGS settings and env dumps.
• CI: skip updating man-db for faster package installs. (Ubuntu)
• use -s in MAKEFLAGS to keep the low verbosity of sub-builds as
  before this patch. Without it, CMake seems to add -w when using
  Ninja.

Due to the way ossfuzz works (?), these changes cannot be tested within
this PR, because part of the repo is pulled from curl/curl-fuzzer master
while testing changes pushed in this PR. This makes the scripts miss to
install Ninja. This setup surprised me. Also not fully from curl
upstream, because some of the parts seem to always come from master.

Helper patch: d0bf19b
Partial test from curl: curl/curl#18202
Bug: curl/curl#18140 (comment)

---

• switch curl build from autotools to cmake. For better performance.
• stop building the curl tool to save time.

Possible future improvements?:

• stop executing Mainline and JustDependencies jobs on curl repo pushes,
  or at least for PR pushes. These jobs test the curl master branch, not
  the PR branch. AFAIU it's meant to be testing the fuzzer sources with
  curl and deps. Maybe a daily build could work for this? Or restrict
  runs to curl master pushes?
  JustDependencies only tests this repo and have no dependency on curl.
• perhaps also stop executing Testi386 for each curl push? 32-bit Linux
  is already tested in curl CI, the rest is ensuring that the dependencies
  and the fuzzer code builds for i386. It seems overkill to test these so
  often, when curl is not likely to cause breakage that we'd not see anyway.
  Perhaps do this as a daily build?
• in the two ossfuzz jobs there is a 3-minute silent section before a
  "Build check passed" entry. I wonder what's happening there, and if it
  could be made faster?
  https://github.com/curl/curl-fuzzer/actions/runs/16771441073/job/47487297844?pr=181#step:3:10581
  https://github.com/google/oss-fuzz/blob/f0f9b221190c6063a773bea606d192ebfc3d00cf/infra/cifuzz/build_fuzzers.py#L207
  https://github.com/google/oss-fuzz/blob/f0f9b221190c6063a773bea606d192ebfc3d00cf/infra/base-images/base-runner/test_all.py
  This seems to be checking the build, which seem overkill when called
  up for PR pushes?
• cache dependencies. At the moment all dependencies are built 5 times
  for each curl PR or master push, taking quite a bit of time, even
  though these dependencies rarely change. With caching it'd be possible
  to save most of the build time, by only building curl and the fuzzer
  itself.
  Ref: Build Caching #183

[vszakats]

@cmeister2 What do you think of these updates?

[cmeister2]

Broadly happy but I would like the commits to be squashed or otherwise rebased into logical blocks when merging.

[vszakats]

I always squash before merge, as the last step, to not lose track of the local history till there may be a need for changes.

The total diff in the meantime: https://github.com/curl/curl-fuzzer/pull/181.diff

(In this case I'm not keen to split into multiple PRs, because the number of touched lines is fairly small, but also very prone to conflicts if torn apart.)