fix(firefox): repack source tarball without obfuscated ff-inst.exe

[anphel31]

Summary

The upstream Mozilla Firefox source tarball ships an obfuscated Windows
executable test fixture at
firefox-148.0/toolkit/components/mediasniffer/test/unit/data/ff-inst.exe.
Obfuscated binaries inside our source RPMs trip the distro's RPM signing
pipeline, which blocks the SRPM from being published.

This PR replaces Source0 with a deterministically-repacked tarball that is
byte-identical to upstream except that ff-inst.exe has been removed.
ff-inst.exe is only used by Firefox's unit tests, which are not run in our
build (run_firefox_tests = 0), so removing it has no effect on the shipped
package.

Changes

• base/comps/firefox/repack-source-tarball.sh — New helper script that:

  • Downloads firefox-148.0.source.tar.xz from archive.mozilla.org.
  • Verifies its SHA-512 against the value in
    specs/f/firefox/sources.
  • Removes ff-inst.exe.
  • Deterministically repacks as firefox-148.0.azl.source.tar.xz:
    • tar --sort=name --owner=0 --group=0 --numeric-owner --mtime=@1577836800 --format=gnu — stable file order, fixed
      ownership and mtime, no PAX extended headers.
    • xz -T 4 -9 --block-size=256MiB — fixed thread count and block size
      so the SHA-256 is identical across re-runs and machines.
  • Emits SHA-256 and SHA-512 of the modified tarball and prints the
    az storage blob upload command for the AZL lookaside cache.

• base/comps/firefox/firefox.comp.toml — Adds:

  • A spec-update-tag overlay rewriting Source0 to
    firefox-%{version}%{?pre_version}.azl.source.tar.xz (top-level
    directory inside the tarball is unchanged, so %setup -n firefox-...
    keeps working).
  • A [[components.firefox.source-files]] entry pinning the new filename,
    its SHA-256, and an origin URL pointing at the AZL lookaside cache.

Reproduction

Anyone can regenerate the modified tarball:

./base/comps/firefox/repack-source-tarball.sh
# Writes to base/build/work/scratch/firefox-repack/firefox-148.0.azl.source.tar.xz
# along with .sha256 / .sha512 sidecar files.

[PawelWMS]

Let's wait for this azldev update to go in, so you can replace the original upstream source and make this TOML config simpler.

[PawelWMS]

This looks wrong. The sources file uses SHA-512 and here we're using SHA-256. In general, I don't think we need any SHA-256 in this script.