xz: update bottle.

Closes #24372.

Signed-off-by: Mike McQuaid <mike@mikemcquaid.com>