Infer dependencies from download strategies and URLs

Currently we handle this for `xz` compressed files by adding an explicit build-time dependency. This is an alternative that was suggested in #20849.