macOS: Reliably apply workaround for system curl 8.{3,4,5} LibreSSL backend

In commit f2596dfa0e (macOS: Work around bug in system curl 8.{3,4,5}
LibreSSL backend, 2024-07-16, v3.30.1~2^2) we tried to prefer
`secure-transport` on problematic versions of curl.  However, the
`curl_global_sslset` setting must be applied before every
`curl_global_init` call, not just the first one.  Otherwise a
second (or subsequent) download won't apply the work-around.

Source/CTest/cmCTestCurl.cxx

@@ -19,9 +19,8 @@ cmCTestCurl::cmCTestCurl(cmCTest* ctest)
   , CurlOpts(ctest)
 {
   this->SetProxyType();
-  cmCurlInitOnce();
   // In windows, this will init the winsock stuff
-  ::curl_global_init(CURL_GLOBAL_ALL);
+  cm_curl_global_init(CURL_GLOBAL_ALL);
   this->Curl = cm_curl_easy_init();
 }
 

Source/CTest/cmCTestSubmitHandler.cxx

@@ -171,9 +171,8 @@ bool cmCTestSubmitHandler::SubmitUsingHTTP(
     headers = ::curl_slist_append(headers, h.c_str());
   }
 
-  cmCurlInitOnce();
   /* In windows, this will init the winsock stuff */
-  ::curl_global_init(CURL_GLOBAL_ALL);
+  cm_curl_global_init(CURL_GLOBAL_ALL);
   cmCTestCurlOpts curlOpts(this->CTest);
   for (std::string const& file : files) {
     /* get a curl handle */

Source/cmCurl.cxx

@@ -52,17 +52,11 @@ static_assert(CURL_SSLVERSION_LAST == 8,
               "A new CURL_SSLVERSION_ may be available!");
 #endif
 
-void cmCurlInitOnce()
+::CURLcode cm_curl_global_init(long flags)
 {
   // curl 7.56.0 introduced curl_global_sslset.
 #if defined(__APPLE__) && defined(CMAKE_USE_SYSTEM_CURL) &&                   \
   defined(LIBCURL_VERSION_NUM) && LIBCURL_VERSION_NUM >= 0x073800
-  static bool initialized = false;
-  if (initialized) {
-    return;
-  }
-  initialized = true;
-
   cm::optional<std::string> curl_ssl_backend =
     cmSystemTools::GetEnvVar("CURL_SSL_BACKEND");
   if (!curl_ssl_backend || curl_ssl_backend->empty()) {
@@ -74,6 +68,7 @@ void cmCurlInitOnce()
     }
   }
 #endif
+  return ::curl_global_init(flags);
 }
 
 cm::optional<int> cmCurlParseTLSVersion(cm::string_view tls_version)

Source/cmCurl.h

@@ -11,7 +11,6 @@
 
 #include <cm3p/curl/curl.h>
 
-void cmCurlInitOnce();
 cm::optional<int> cmCurlParseTLSVersion(cm::string_view tls_version);
 cm::optional<std::string> cmCurlPrintTLSVersion(int curl_tls_version);
 std::string cmCurlSetCAInfo(::CURL* curl, const std::string& cafile = {});
@@ -19,4 +18,5 @@ std::string cmCurlSetNETRCOption(::CURL* curl, const std::string& netrc_level,
                                  const std::string& netrc_file);
 std::string cmCurlFixFileURL(std::string url);
 
+::CURLcode cm_curl_global_init(long flags);
 ::CURL* cm_curl_easy_init();

Source/cmFileCommand.cxx

@@ -2115,8 +2115,7 @@ bool HandleDownloadCommand(std::vector<std::string> const& args,
   url = cmCurlFixFileURL(url);
 
   ::CURL* curl;
-  cmCurlInitOnce();
-  ::curl_global_init(CURL_GLOBAL_DEFAULT);
+  cm_curl_global_init(CURL_GLOBAL_DEFAULT);
   curl = cm_curl_easy_init();
   if (!curl) {
     status.SetError("DOWNLOAD error initializing curl.");
@@ -2492,8 +2491,7 @@ bool HandleUploadCommand(std::vector<std::string> const& args,
   url = cmCurlFixFileURL(url);
 
   ::CURL* curl;
-  cmCurlInitOnce();
-  ::curl_global_init(CURL_GLOBAL_DEFAULT);
+  cm_curl_global_init(CURL_GLOBAL_DEFAULT);
   curl = cm_curl_easy_init();
   if (!curl) {
     status.SetError("UPLOAD error initializing curl.");