feat: backport vendored openconnect build to 2.3.x

[yuezk]

Summary

• backport the vendored OpenConnect and libxml2 build flow to 2.3.x
• bundle vpnc-script and hipreport.sh under app-owned paths and add /usr/lib/gpclient fallback lookup
• add gpclient hip and align packaging and release workflows with the vendored runtime

Main Changes

• build crates/openconnect from vendored OpenConnect sources with the required patch set
• add bundled script installation and prefer app-owned HIP and vpnc script paths during lookup
• update Debian, RPM, Arch, Nix, and GitHub Actions packaging paths and build dependencies for LIBXML2_STATIC=1

API / Usage

• gpclient now exposes a hip subcommand on 2.3.x
• gpclient connect --hip now resolves the bundled HIP wrapper by default
• script discovery prefers /usr/libexec/gpclient/... and also accepts /usr/lib/gpclient/...

Verification

• cargo check -p gpclient
• cargo build -p gpclient
• cargo check -p gpservice
• ./target/debug/gpclient --help
• ./target/debug/gpclient hip --cookie 'user=testuser&domain=example&preferred-ip=10.0.0.2' --md5 deadbeef --client-os Linux
• GPCLIENT_BIN=... packaging/files/usr/libexec/gpclient/hipreport.sh --cookie ... --md5 deadbeef --client-os Linux
• git diff --check