RFE: add curl to projects being built

[davidmalcolm]

https://curl.se/ is:

• written in C
• has had numerous CVEs, and has had security audits: https://curl.se/docs/security.html

It might be interesting to build a historical version with some known flaws to see if we can detect them.

[bagder]

(curl author here)

I would of course be delighted to see (and work with) the outcome of that. I have toyed with gcc -fanalyzer on the curl code several times in the past but never gotten over the large amount of false positives it used to cause which made it tedious to work with. But it was a while ago I tried it last now. Let me know if there is a way I can help out.

This page could possibly help identifying an old curl version to test with.