curl-sys' vendoring depends on libz-sys vendoring

[micolous]

When libz-sys fails to find zlib, it falls back to building it from source.

However, when curl-rust vendors libcurl (when it falls back), it transitively depends on either zlib being present in system include paths or libz-sys vendoring it into the same paths:

https://github.com/alexcrichton/curl-rust/blob/ff6ad21cc1034826b2ab3f8be0653d8c446e1bdc/curl-sys/build.rs#L57-L59

libz-sys recently attempted to use pkg-config on Windows, which broke curl-sys using an MSVC toolchain (from inside an MSYS2 environment, presumably without vcpkg), because it would no longer need to build zlib from source: https://github.com/rust-lang/libz-sys/issues/143

However, because curl-sys does not support pkg-config (#486), on Windows:

• on an MSVC host and MSVC target, it will attempt to find libcurl with vcpkg (#509 would slightly improve this)
• otherwise, it just builds libcurl from source

When building from source, curl-sys generates a pkg-config file, but doesn't add any linkage or include path information for zlib:

https://github.com/alexcrichton/curl-rust/blob/ff6ad21cc1034826b2ab3f8be0653d8c446e1bdc/curl-sys/build.rs#L98-L100

...and enables zlib support:

https://github.com/alexcrichton/curl-rust/blob/ff6ad21cc1034826b2ab3f8be0653d8c446e1bdc/curl-sys/build.rs#L127

...it might get something from vcpkg if built on an MSVC host (because build.rs cfg directives are based on the host, not the target):

https://github.com/alexcrichton/curl-rust/blob/ff6ad21cc1034826b2ab3f8be0653d8c446e1bdc/curl-sys/build.rs#L296-L299

...but otherwise this means zlib.h needs to be in $OUT_DIR/include (which it gets from libz-sys' vendoring) or in the system include paths (which it gets on most non-Windows platforms).

When vendoring libcurl, curl-sys should find zlib properly (ideally, the same way as libz-sys does).

It would be better if you needed to explicitly enable vendoring in this library, because while "silent fallback" can be helpful, it leads to surprising behaviour like this, and makes it more difficult to audit your dependencies.