ci: Add nightly job to build CMake with vendored curl on macOS

We now build with the system curl on macOS by default.
Explicitly test that the vendored curl still works.

.gitlab-ci.yml

@@ -821,6 +821,16 @@ b:macos-arm64-ninja-symlinked:
     variables:
         CMAKE_CI_JOB_NIGHTLY: "true"
 
+b:macos-arm64-curl:
+    extends:
+        - .macos_arm64_curl
+        - .cmake_build_macos
+        - .cmake_build_artifacts
+        - .macos_arm64_tags
+        - .run_manually
+    variables:
+        CMAKE_CI_JOB_NIGHTLY: "true"
+
 b:macos-arm64-pch:
     extends:
         - .macos_arm64_pch
@@ -874,6 +884,19 @@ t:macos-arm64-ninja-symlinked:
         CMAKE_CI_JOB_NIGHTLY: "true"
         CMAKE_CI_JOB_NIGHTLY_NINJA: "true"
 
+t:macos-arm64-curl:
+    extends:
+        - .macos_arm64_curl
+        - .cmake_test_macos
+        - .macos_arm64_tags
+        - .run_dependent
+    dependencies:
+        - b:macos-arm64-curl
+    needs:
+        - b:macos-arm64-curl
+    variables:
+        CMAKE_CI_JOB_NIGHTLY: "true"
+
 b:macos-x86_64-makefiles:
     extends:
         - .macos_x86_64_makefiles

.gitlab/ci/configure_macos_arm64_curl.cmake

@@ -0,0 +1,12 @@
+# Build with our vendored curl instead of the default system version.
+set(CMAKE_USE_SYSTEM_CURL "OFF" CACHE BOOL "")
+
+set(CMake_TEST_TLS_VERIFY_URL "https://gitlab.kitware.com" CACHE STRING "")
+set(CMake_TEST_TLS_VERIFY_URL_BAD "https://badtls-expired.kitware.com" CACHE STRING "")
+
+# Test that our vendored curl accepts CURL_SSLVERSION_TLSv1_3.  It is passed
+# through to Secure Transport, but macOS does not actually enforce it.
+set(CMake_TEST_TLS_VERSION "1.3" CACHE STRING "")
+
+include("${CMAKE_CURRENT_LIST_DIR}/configure_macos_common.cmake")
+include("${CMAKE_CURRENT_LIST_DIR}/configure_common.cmake")

.gitlab/os-macos.yml

@@ -47,6 +47,13 @@
         CMAKE_CI_IN_SYMLINK_TREE: 1
         CMAKE_CI_BUILD_DIR: "real_work/work/build"
 
+.macos_arm64_curl:
+    extends: .macos_build
+
+    variables:
+        CMAKE_CONFIGURATION: macos_arm64_curl
+        CTEST_NO_WARNINGS_ALLOWED: 1
+
 .macos_arm64_pch:
     extends: .macos_arm64_ninja