depends: unbound: update to 1.22.0

[tobtoht]

• https://nvd.nist.gov/vuln/detail/CVE-2024-1931
• https://nvd.nist.gov/vuln/detail/CVE-2024-8508

Supply chain security

• ☑ The tarball was signed with the same GPG key as the previous update (1.19.1)
  • EDFAA3F2CA4E6EB05681AF8E9F6F1C2D7E045F8D
• ☑ The repository has not changed ownership since the previous update
• ☑ The git tag was GPG signed by the maintainer
• ☑ Blobs were removed from the source in preprocess_cmds
• ☑ The tarball is used by 5 or more distributions.
• ⚠ The source archive does not match the contents of the git repo. The following files remain after cleanup:

util/configlexer.c
util/configparser.c
util/configparser.h

[iamamyth]

Could make this a little easier to read with alternate shell syntax:
rm configure~ doc/*.{odp,pdf} contrib/*.tar.{gz,bz2} ...

[tobtoht]

Brace expansion isn't defined in POSIX. I didn't know this until I found out that:

In depends CI, which runs on Ubuntu 20.04, the SHELL environment variable isn't set by default causing make to fall back to /bin/sh, resulting in an error on this line. On 20.04 /bin/sh is Dash which tries to be POSIX compliant and does not support brace expansion.

For portability reasons, I have reverted back to the less readable syntax.

[iamamyth]

⚠ The source archive does not match the contents of the git repo.

I did a side-by-side compare and the mismatch owes to makedist.sh. In addition to replacing placeholder variables in various files, the distribution process auto-generates the lexer and parser files using flex and bison/yacc, respectively.

[iamamyth]

One minor trivial style suggestion, but this looks OK.