[datlechin]

Summary

• Pins libs-4: libpq 17.4 (with libpgcommon, libpgport) built --with-gssapi, and MariaDB Connector/C 3.4.4 with auth_gssapi_client built in, both against the GSS framework, all slices.
• Kerberos sign-in for PostgreSQL and MariaDB (feat(connections): sign in to PostgreSQL and MariaDB with Kerberos #3754, for Kerberos sign-in for PostgreSQL and MariaDB #3629) needs them. Until this merges, a Kerberos sign-in fails with "GSSAPI authentication not supported".
• Built with feat(connections): sign in to PostgreSQL and MariaDB with Kerberos #3754's build-libpq.sh and build-mariadb.sh under ZERO_AR_DATE=1, against OpenSSL 3.5.9, the libssl/libcrypto libs-3 ships.
• libssl, libcrypto, libssh2, every other library and the iOS xcframeworks are unchanged from libs-3. iOS refuses Kerberos, so its LibPQ and MariaDB xcframeworks stay as they are.
• Every rebuilt archive reports minos 13.0, same as libs-3's.
• Published with apple/scripts/publish-libs.sh.
• MySQLLinkage and PostgreSQLLinkage link -framework GSS, which the new archives reference. feat(connections): sign in to PostgreSQL and MariaDB with Kerberos #3754 adds the same lines.

Test plan

• publish-libs.sh --dry-run reported only the 16 rebuilt archives. download-libs.sh --force verifies libs-4 against these checksums.
• apple/scripts/probes/check-kerberos-sign-in.sh against these builds and libs-3's OpenSSL, arm64 and x86_64 (Rosetta), Docker MIT KDC: PostgreSQL signs in with gssencmode=require (GSS encryption on) and disable, MariaDB signs in with gssapi, no ticket and a wrong password are refused.
• nm: libpq defines pg_GSS_have_cred_cache and pqsecure_open_gss, libmariadb auth_gssapi_client_client_plugin. Every gss_* reference resolves in GSS.framework. Against libs-3, the only new external references are gss_*, plus strnlen in libmariadb.

Needed by #3754.