build git ourselves for TLS 1.2 support

[reaperhulk]

As of today GitHub no longer allows connections < TLS 1.2. This breaks git in the manylinux1 containers since they're linked against system OpenSSL. It also breaks building the containers at all because they try to fetch the newer curl from github via the old system curl.

To resolve this we can link our own copy of git against the OpenSSL we link the Pythons against, but there are a few knock-on effects...

1. We have to fetch a curl from a debian mirror (or switch to using Docker's ADD) to solve the bootstrap problem. To make this minimally invasive I've just swapped to the debian mirror and downgraded curl for now.
2. We have to reorder our various package compiles to prioritize getting a functional curl ASAP.
3. libcurl (which we need for git) can't be deleted immediately. In fact, I can't get git to build against a static libcurl (it complains about symbols that should be only in libcrypto/libssl), so for the moment I've converted it to a dynamic lib and we never delete it. That shouldn't be a big deal as the libcurl we install has a different soversion.
4. We need expat-devel because git depends on libexpat.
5. cmake28 uses system curl still, so that's likely to cause anybody using cmake to fetch remote resources pain in the near future.

[njsmith]

[reaperhulk]

(This isn't ready for merge yet as git is not actually building properly because everything is awful)

[reaperhulk]

Looks like it's all building successfully now. This should be ready for review.

[xhochy]

+1, this looks good (but I'm not a maintainer here)

[xhochy]

The reason for the version downgrade is probably due to the mirror switch to Debian?

[reaperhulk]

For others who might find this PR, yes this was the reason. I'd prefer to just go to 7.58.0, but that would require switching to ADD in docker. I do think we should switch to that and use less bash to build this thing now that --squash is an option, but that's best done in manylinux2.

[njsmith]

Well, we're clearly trying to bail out a boat while it sinks, so I guess we better hurry up with the bailing...

(PEP 571 will be what we evacuate to.)

[njsmith]

Github's just giving me a "server error" when I try to click merge...