use old xz mirror, fix CVE-2024-3094

[crazywhalecc]

What does this PR do?

Fix #398

Checklist before merging

If your PR involves the changes mentioned below and completed the action, please tick the corresponding option.
If a modification is not involved, please skip it directly.

• If it's a extension or dependency update, make sure adding related extensions in src/global/test-extensions.php.
• If you changed the behavior of static-php-cli, add docs in static-php/static-php-cli-docs .
• If you updated config/xxxx.json content, run bin/spc dev:sort-config xxx.