Don't rely on linux distribution's package for `git-lfs`

[lemeurherveCB]

Related:

* [New release to remediate CVEs for compliance git-lfs/git-lfs#6051](https://github.com/git-lfs/git-lfs/issues/6051)

Note: this PR is only for Windows. Currently we rely on each Linux distribution's package for git-lfs for Linux images

Originally posted by @dduportal in #1007 (comment)

Just tested building a debian image, it includes git-lfs 3.3.0-1+deb12u1, lagging behind official releases. (3.7.0 currently)

WDYT about having a distinct installation for git and git-lfs to ensure which versions of them are included in Linux images instead of relying on distribution packaging (and from which we don't know in advance which versions they're including)?

[dduportal]

For git-lfs it is easy to contribute: we already have a specific installation on jenkinsci/docker using the tar gz distribution: https://github.com/jenkinsci/docker/blob/ba178d816f63543645d27f90638c5d68dc6037c0/debian/bookworm/hotspot/Dockerfile#L57-L65

It's "easy" because it works out of the box as a "statically" compiled binary (in theory: I haven't checked the dynamic library links neither the compilation flags).

For git it is not that simple: usually Git has dependencies with some distribution library to support cryptography, secrets managements and many other things.
There are (many good) reasons why distributions keep maintaining their own package of tools and are providing backports (for security and some feature). We might not want to create "frankeinstein" images with only a partial subset of features to provide for end users.

[lemeurherveCB]

I knew there was a reason for git 😅

Editing my issue to only include git-lfs.

[MarkEWaite]

My experience matches with @dduportal .

The git-lfs project knows that their binary will be installed in many locations with many different git versions and they have successfully kept it portable to multiple git versions, multiple operating systems, and multiple operating system versions.

The git project has a different expectation that is better suited to operating systems configuring, building, and packaging git for that specific operating system.

Thanks for focusing this issue on git-lfs. I think that is the right choice.