xz: update and change to git

the xz backdoor caused github to disable the repo. Changing to
the tukaani git to allow builds to happen.

Moved from tarball to git clone for building xz to avoid any
other potential tarball poisoning by JiaT75, using the commit
tagged as 5.2.5; the latest full release tag available without
any commits by JiaT75.