curl: bump to latest and pass --with-sysroot

the previous cross-compilation related fixes were only necessary
because --with-sysroot was missing.