Makefile: single-run archive bootstrap and honest dependencies

[shreemaan-abhishek]

Follow-ups from the build-graph review on #53, kept out of that PR since all of them predate it.

• $(XMLSEC1_STATIC_LIBS): lists two targets on one rule, so make expands it into two independent rules sharing the wget/tar/configure recipe: make -B build runs the bootstrap twice. A grouped target (&:, GNU Make >= 4.3) or a stamp file both archives depend on fixes the double run; the stamp is the portable choice (macOS ships make 3.81).
• With the double run fixed, saml.so can again list the archives as prerequisites, so a rebuilt xmlsec relinks instead of shipping stale whole-archived objects.
• Object files rebuild on any src/*.h change via a blanket prerequisite; compiler-generated dependencies (-MMD) would narrow that honestly.
• Variables (OPENSSL_DIR, CFLAGS) trigger no rebuild; a flags stamp would. Related: the default OPENSSL_DIR ?= /usr/local/openresty/openssl111 targets the older runtime line, and gcc silently ignores the missing include/lib dirs when it is absent, linking the system OpenSSL.
• Pre-existing and observed on the merge-base of fix: accept OneTimeUse, and let the replay record honour it #53: make -j4 race on a clean tree, and make saml.so on a clean tree failing at lua_saml.o before the archives exist.