Vendoring x86_64 executables of unknown origin is a security problem

Steps to reproduce

Hi! I package this project for Arch Linux.

For some time now, the prebuilt application bundle vendors a (currently) one year old prebuilt version of kitinerary-extractor (https://invent.kde.org/pim/kitinerary/).

From a security perspective, this is quite bad, for several reasons:

• It's completely unclear who built this binary with which flags under what circumstances on whose machine
• it is dynamically linking against zlib
• it is an outdated version of a binary that is readily available on Linux distributions (see https://repology.org/project/kitinerary/versions) and should therefore not be vendored into a project (but can readily be used by optionally depending on kitinerary)

Expected behavior

This project does not vendor any CPU architecture dependent code with unclear origin.

Actual behavior

This project vendors kitinerary-extractor of https://invent.kde.org/pim/kitinerary/ via https://github.com/ChristophWurst/kitinerary-bin/

Mail app version

3.4.0

Mailserver or service

n/a

Operating system

Arch Linux

PHP engine version

PHP 8.2

Web server

Nginx

Database

MariaDB

Additional info

While vendoring a readily available executable is a problem for supply chain security (and also for detecting supply chain attacks) in itself, there is also a licensing problem.
kitinerary is licensed under the terms of several licenses that must be reproduced alongside any binary distribution: https://invent.kde.org/pim/kitinerary/-/tree/master/LICENSES

Inspect the prebuilt application bundle and the kitinerary-bin source referenced in the issue to trace how kitinerary-extractor enters the distribution. Review the binary's origin, dynamic zlib dependency, supported Linux packaging options, and required license files. Done means the application no longer vendors an executable of unclear origin and its replacement or dependency handling satisfies the stated licensing and supply-chain requirements.