switch to xmake for package management (#611)

This change removes our dependency on vcpkg for package management, in favour of bringing some code in-tree in the `thirdparty` folder as well as using the xmake build-in package management feature. For the latter, all the package definitions are maintained in the zen repo itself, in the `repo` folder.

It should now also be easier to build the project as it will no longer depend on having the right version of vcpkg installed, which has been a common problem for new people coming in to the codebase. Now you should only need xmake to build.

* Bumps xmake requirement on github runners to 2.9.9 to resolve an issue where xmake on Windows invokes cmake with `v144` toolchain which does not exist
* BLAKE3 is now in-tree at `thirdparty/blake3`
* cpr is now in-tree at `thirdparty/cpr`
* cxxopts is now in-tree at `thirdparty/cxxopts`
* fmt is now in-tree at `thirdparty/fmt`
* robin-map is now in-tree at `thirdparty/robin-map`
* ryml is now in-tree at `thirdparty/ryml`
* sol2 is now in-tree at `thirdparty/sol2`
* spdlog is now in-tree at `thirdparty/spdlog`
* utfcpp is now in-tree at `thirdparty/utfcpp`
* xmake package repo definitions is in `repo`
* implemented support for sanitizers. ASAN is supported on windows, TSAN, UBSAN, MSAN etc are supported on Linux/MacOS though I have not yet tested it extensively on MacOS
* the zencore encryption implementation also now supports using mbedTLS which is used on MacOS, though for now we still use openssl on Linux
* crashpad
* bumps libcurl to 8.11.0 (from 8.8.0) which should address a rare build upload bug

1 files changed, 28 insertions, 2 deletions

diff --git a/thirdparty/VERSIONS.md b/thirdparty/VERSIONS.md
index 02f3ebf88..38a1415d3 100644
--- a/thirdparty/VERSIONS.md
+++ b/thirdparty/VERSIONS.md
@@ -1,5 +1,31 @@
-# Thirdparty library snapshot versions
+# Thirdparty code tree
+
+This tree also includes some code which has previously been consumed via vcpkg. While transitioning
+to the xmake package management system we decided to put some of the code inline in the tree
+instead of referencing the code using packages. 
+
+The choice whether to use the xrepo functionalityor dropping the code here might be because it 
+makes debugging or using things like sanitizers easier, or simply because the library is 
+header-only and very small. In some cases the choice was made to allow diverging from the
+official release, to enable easier migration and eventually a complete removal of the external 
+dependency.
+
+## Thirdparty library snapshot versions
 
 * asio - v1.29.0 from https://github.com/chriskohlhoff/asio/archive/refs/tags/asio-1-29-0.zip
-* spdlog - v1.16.0 from https://github.com/gabime/spdlog/releases/tag/v1.16.0.zip
+* BLAKE3 - v1.8.3 from https://github.com/BLAKE3-team/BLAKE3/archive/refs/tags/1.8.2.tar.gz
 * cpr - v1.10.5 from https://github.com/libcpr/cpr/releases/tag/v1.10.5.zip
+* cxxopts - v3.2.1 from https://github.com/jarro2783/cxxopts/archive/refs/tags/v3.2.1.tar.gz
+* doctest - v2.4.12 from https://github.com/doctest/doctest/releases/download/v2.4.12/doctest.h
+* fmt - v12.0.0 from https://github.com/fmtlib/fmt/archive/refs/tags/12.0.0.tar.gz
+* robin-map - v1.4.0 from https://github.com/Tessil/robin-map/archive/refs/tags/v1.4.0.tar.gz
+* ryml - v0.5.0 from https://github.com/biojppm/rapidyaml (note that there are submodules here which have also been fetched, after stripping all `.git` metadata, for future updates it's probably easier to just grab the .zip/.tar.gz since it includes all submodules)
+* sol2  - v3.5.0 from https://github.com/ThePhD/sol2/archive/refs/tags/v3.5.0.tar.gz (single/single.py generates the headers)
+* spdlog - v1.16.0 from https://github.com/gabime/spdlog/releases/tag/v1.16.0.zip
+
+The above code should all be without modifications at the time of writing. It's not recommended
+that you make changes in the third party code unless there are good reasons.
+
+There will be some exceptions in the near future, where we want to remove a dependency it might
+be useful to start the migration inside the thirdparty code itself, but this should be flagged
+clearly in this file when it happens.