Add basic auditor / pipeline support for static libraries

[topolarity]

Add basic audit support for StaticLibraryProduct, as introduced in #93.

The auditor doesn't have much to do here, since static libraries do not track dependency metadata or SONAME, etc. However we do need to possibly copy dependency information from the dynamic variant of this library and/or verify that the user's explicit-provided deps / static_deps information is reasonable.

This is only the preliminary support for now - just enough to successfully create static library products in a JLL.

Another follow-up will add some "proper" audit support to verify that linking with the provided deps / static_deps is possible / successful.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[staticfloat]

Honestly way less accounting than I was expecting, especially the parts where we unwrap the dynamic libraries to get the static ones. Nice work, it feels quite natural.

[staticfloat]

The intended flow in scan_files() is to actually determine from file contents the types of files, so I would populate a list of static_libraries by looking at files with something like this:

function is_static_archive(path)
    open(path) do io
        magic = read(io, 8)
        magic == b"!<arch>\n" && return true
        # macOS universal archive: fat header, then an ar archive at the first slice's offset
        if length(magic) == 8 && ntoh(reinterpret(UInt32, magic[1:4])[1]) == 0xcafebabe
            skip(io, 8)
            seek(io, ntoh(read(io, UInt32)))
            return read(io, 8) == b"!<arch>\n"
        end
        return false
    end
end

in order to build up an exhaustive list of static libraries, and then from that construct static_product_map. This better matches the behavior of the other lists of files/products.

[topolarity]

Good point. I've pushed a rework, dependent on JuliaIO/ObjectFile.jl#63 and JuliaIO/ObjectFile.jl#59

[staticfloat]

This is gonna be pretty messy, because unlike the dynamic counterpart, we have no way to only check the first-order dependencies (e.g. are all DT_NEEDED's satisfied) with a static archive we'd have to actually have all recursive dependencies and check that all symbols are resolvable.

Tell me you want to write a linker without telling me you want to write a linker.

[topolarity]

Yeah. I suspect we'll probably use the actual linker to do this test link / audit, since that's the intended use case anyway. Luckily since we are linking statically we can do that on all targets, not just the host platform.