xz: update and change to git

the xz backdoor caused github to disable the repo. Changing to the tukaani git to allow builds to happen.

Moved from tarball to git clone for building xz to avoid any other potential tarball poisoning by JiaT75, using the commit tagged as 5.2.5.