[liblzma] Change repo

[JackBoosY]

In order to solve the download failure problem caused by the disabled repo due to the planting of backdoor, replace the repo to sourceforge.

Affected version >=5.6.0, so there is no risk on the vcpkg side.

Thanks @AbdulsalamAmin.

Fixes #37893

[JackBoosY]

Related #37957

[JackBoosY]

The real problem is SHA512 not matched with the origin one.

[JonLiu1993]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[carsten-grimm-at-ipolog]

You could use the version number from the variable: "xz-${VERSION}.tar.gz".

[JackBoosY]

Yeah that's easy to fix, however, the current problem is the SHA512 value changed, which cannot guarantee the source code is same with the origin one.

[carsten-grimm-at-ipolog]

Yes, this suggestion is unrelated to the SHA512.

[JackBoosY]

Yes, this suggestion is unrelated to the SHA512.

So we need to wait until accept to switch to sourceforge first.

[talregev]

@JackBoosY
You can change it to this if you don't want to change the hash.
https://github.com/xz-mirror/xz

Also
The original is here:
https://git.tukaani.org/?p=xz.git;a=summary

But I think it not the same hash.

[BillyONeal]

Thanks for the workaround attempt :)

See #37841 (comment) : the repo should be public again.