Makefile: single-run archive bootstrap and honest dependencies

Follow-ups from the build-graph review on #53, kept out of that PR since all of them predate it.

• $(XMLSEC1_STATIC_LIBS): lists two targets on one rule, so make expands it into two independent rules sharing the wget/tar/configure recipe: make -B build runs the bootstrap twice. A grouped target (&:, GNU Make >= 4.3) or a stamp file both archives depend on fixes the double run; the stamp is the portable choice (macOS ships make 3.81).
• With the double run fixed, saml.so can again list the archives as prerequisites, so a rebuilt xmlsec relinks instead of shipping stale whole-archived objects.
• Object files rebuild on any src/*.h change via a blanket prerequisite; compiler-generated dependencies (-MMD) would narrow that honestly.
• Variables (OPENSSL_DIR, CFLAGS) trigger no rebuild; a flags stamp would. Related: the default OPENSSL_DIR ?= /usr/local/openresty/openssl111 targets the older runtime line, and gcc silently ignores the missing include/lib dirs when it is absent, linking the system OpenSSL.
• Pre-existing and observed on the merge-base of #53: make -j4 race on a clean tree, and make saml.so on a clean tree failing at lua_saml.o before the archives exist.

Start with the Makefile and reproduce the reported clean-tree failures using make -j4 and make saml.so. Trace the archive, saml.so, object, and OpenSSL-related prerequisites; done means bootstrap runs once, parallel builds are reliable, rebuilt archives relink, and header or flag changes trigger the intended rebuilds.