Are curl and c-ares really only build-time deps?