Link SQLite dynamically through cgo

Link SQLite dynamically through cgo

modernc.org/sqlite is a pure-Go translation of SQLite and the largest thing in
the binary: it is about 4 MB of the 23.1 MB the release flags produce, while the
cgo driver against the system library costs about 0.25 MB. With the same flags
the amd64 binary drops to 19.3 MB (16% smaller), the .deb from 18.1 MB to 8.0 MB,
and the cgo driver is also faster on database-heavy paths: the repository index,
sessions, and the CI run store.

The trade is that the binary is no longer self-contained. It needs
libsqlite3.so.0 at runtime, so the .deb depends on libsqlite3-0 and the .rpm on
sqlite-libs, and building needs a C compiler and the SQLite development headers.
arm64 is still cross-compiled on the amd64 release image, with
gcc-aarch64-linux-gnu and libsqlite3-dev:arm64 installed beside the amd64 ones;
both architectures still build byte for byte from the same tag.

The DSNs carried modernc-only pragma parameters. mattn/go-sqlite3 spells them
_busy_timeout, _journal_mode, and _foreign_keys, and the driver is sqlite3, so
the connections keep the busy timeout, WAL mode, immediate write transactions,
and foreign keys they had before. The release image also defines the ci user the
verify image already has, so the release test step runs ssh as the host's uid
when the workflow is reproduced locally.