xz-utils CVE fallout broke our build

[totaam]

We have a (non-vulnerable it seems) download link to xz:

gtk-osx-build/modulesets-stable/bootstrap.modules

Lines 38 to 41 in 49eb381

	<branch module="xz/xz-5.4.3.tar.bz2"
	version="5.4.3"
	hash="sha256:9243a04598d7a70c1f567a0143a255581ac5c64b140fd55fd5cbc1e00b0e6f90"
	repo="tukaani.org" />

And when github took the whole project down because of CVE-2024-3094, this broke our builds..

I'm not saying that taking the project down was not the right thing to do.

Just a cautionary tale about reproducible builds.

[totaam]

Updated xz to 5.6.2 in 1050b4d