Build: fontsan components aren't fetched

[okias]

Build setup: #28088

                                "sed -i 's|use-rustup = true|use-rustup = false|' .servobuild",
                                "./mach build -d --verbose"

     Running `/run/build/servo/target/debug/build/fontsan-14927bf23654e8c5/build-script-build`
error: failed to run custom build command for `fontsan v0.4.0 (https://github.com/servo/fontsan#29e879c8)`

Caused by:
  process didn't exit successfully: `/run/build/servo/target/debug/build/fontsan-14927bf23654e8c5/build-script-build` (exit code: 101)
  --- stdout
  running: "cmake" "/run/build/servo/cargo/vendor/fontsan/src" "-DCMAKE_INSTALL_PREFIX=/run/build/servo/target/debug/build/fontsan-e60af307689dbe77/out" "-DCMAKE_C_FLAGS= -ffunction-sections -fdata-sections -fPIC --target=x86_64-unknown-linux-gnu -pipe -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection" "-DCMAKE_C_COMPILER=/usr/bin/clang" "-DCMAKE_CXX_FLAGS= -ffunction-sections -fdata-sections -fPIC --target=x86_64-unknown-linux-gnu -pipe -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection" "-DCMAKE_CXX_COMPILER=/usr/bin/clang++" "-DCMAKE_ASM_FLAGS= -ffunction-sections -fdata-sections -fPIC --target=x86_64-unknown-linux-gnu -pipe -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection" "-DCMAKE_ASM_COMPILER=/usr/bin/clang" "-DCMAKE_BUILD_TYPE=Debug"
  -- The C compiler identification is Clang 10.0.1
  -- The CXX compiler identification is Clang 10.0.1
  -- Detecting C compiler ABI info
  -- Detecting C compiler ABI info - done
  -- Check for working C compiler: /usr/bin/clang - skipped
  -- Detecting C compile features
  -- Detecting C compile features - done
  -- Detecting CXX compiler ABI info
  -- Detecting CXX compiler ABI info - done
  -- Check for working CXX compiler: /usr/bin/clang++ - skipped
  -- Detecting CXX compile features
  -- Detecting CXX compile features - done
  -- Configuring done

  --- stderr
  CMake Deprecation Warning at CMakeLists.txt:2 (cmake_minimum_required):
    Compatibility with CMake < 2.8.12 will be removed from a future version of
    CMake.

    Update the VERSION argument <min> value or use a ...<max> suffix to tell
    CMake that the project does not need compatibility with older versions.


  CMake Error at CMakeLists.txt:148 (add_library):
    Cannot find source file:

      ots/third_party/woff2/include/woff2/decode.h

    Tried extensions .c .C .c++ .cc .cpp .cxx .cu .m .M .mm .h .hh .h++ .hm
    .hpp .hxx .in .txx .f .F .for .f77 .f90 .f95 .f03 .ispc


  CMake Error at CMakeLists.txt:147 (add_library):
    Cannot find source file:

      ots/third_party/brotli/c/common/dictionary.c

    Tried extensions .c .C .c++ .cc .cpp .cxx .cu .m .M .mm .h .hh .h++ .hm
    .hpp .hxx .in .txx .f .F .for .f77 .f90 .f95 .f03 .ispc


  CMake Error at CMakeLists.txt:146 (add_library):
    Cannot find source file:

      ots/src/cff.cc

    Tried extensions .c .C .c++ .cc .cpp .cxx .cu .m .M .mm .h .hh .h++ .hm
    .hpp .hxx .in .txx .f .F .for .f77 .f90 .f95 .f03 .ispc


  CMake Error at CMakeLists.txt:148 (add_library):
    No SOURCES given to target: woff2


  CMake Error at CMakeLists.txt:147 (add_library):
    No SOURCES given to target: brotli


  CMake Error at CMakeLists.txt:146 (add_library):
    No SOURCES given to target: ots


  CMake Generate step failed.  Build files cannot be regenerated correctly.
  thread 'main' panicked at '
  command did not execute successfully, got: exit code: 1

  build script failed, must exit now', /run/build/servo/cargo/vendor/cmake-0.1.44/src/lib.rs:885:5
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Seems very close to: #13253

[okias]

I outsmarted fontsan by downloading tarball and placing it into expected location:

[
        {
                "type": "archive",
                "url": "https://github.com/khaledhosny/ots/archive/77bcc681fdd2288d5deed87772c365c01ca3be7d.tar.gz",
                "sha256": "8b1b1d55ccc0487f74700723799c07a2b984c5dbed995b8fda15277a20b9b18a",
                "dest": "cargo/vendor/fontsan/src/ots"
        },
        {
                "type": "archive",
                "url": "https://github.com/google/brotli/archive/5b4769990dc14a2bd466d2599c946c5652cba4b2.tar.gz",
                "sha256": "3a3c53b56a961ba24d331a5b7882b0bec7f2e3c7be7cf77b9db18271c28151ce",
                "dest": "cargo/vendor/fontsan/src/ots/third_party/brotli"
        },
        {
                "type": "archive",
                "url": "https://github.com/google/woff2/archive/b677a07ffdda0ecb5fd18c3816c5930c7a883b7d.tar.gz",
                "sha256": "1b31324ef6fae2600d823234c0349e1bf1eebb0ee5e951a028fce99028dd5ff6",
                "dest": "cargo/vendor/fontsan/src/ots/third_party/woff2"
        }
]

but most likely it shouldn't fail this way.

Btw. I noticed that current commit where it's fixed on it's from 2017, while fontsan project seems to be alive, so not sure about security implications.