VCPKG ZLIB version obsolete

[gearama]

Describe the bug
VCPKG version of ZLIB is 1.2.12 the publisher removed this version in favor of 1.12.13 due to a security issue in 1.2.12 https://nvd.nist.gov/vuln/detail/CVE-2022-37434
https://zlib.net/
We need to get ZLIB publisher to update the version.

Exception or Stack Trace
Add the exception log and stack trace if available

To Reproduce
Steps to reproduce the behavior:

vcpkg install zlib

Error: Failed to download from mirror set:
https://www.zlib.net/zlib-1.2.12.tar.gz

curl https://www.zlib.net/zlib-1.2.12.tar.gz

<title>404 Not Found</title>

Code Snippet
Add the code snippet that causes the issue.

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Setup (please complete the following information):

• OS: [e.g. iOS]
• IDE : [e.g. IntelliJ]
• Version of the Library used

Additional context
Add any other context about the problem here.

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Bug Description Added
• Repro Steps Added
• Setup information Added

[gearama]

There are three ways to fix this this issue:

1. use vcpkg cached packages in the pipeline, this might cause for customers trying to compile locally
2. use overrides in vcpkg.json which will force vcpkg to pull zlib from its own cache ( in github) instead of the author code source
3. update the vcpkg baseline from the current value to 659b6b5eeacb50ffe25856413960d231ce1a4b58 , which is the vcpkg version that defaults to getting packages from it's own cache vs the owners code repo.

Downsides

1. i suspect that customers trying to get our packages would still encounter this issue thus rendering them unable to use the azure sdk for cpp
2. this is the quickest fix as it adresses strictly the package in question and does not affect anything else regardless of the caching
3. while this would seem to be the cleanest solution, the linux builds break due to errors in curl code due to type name changes in the newer version pulled from the package at that baseline.

[ahsonkhan]

@BillyONeal, @ras0219-msft - what do you guys recommend the appropriate fix here? It looks like the vcpkg.json file in main still says zlib 1.2.12:
https://github.com/microsoft/vcpkg/blob/79fa9d85cb4510b05c2657bd7ec8a6a2cb266dc5/ports/zlib/vcpkg.json#L3

We shouldn't need to explicitly list all transitive dependencies with vcpkg, correct? We depend on curl, which depends on it.
https://github.com/microsoft/vcpkg/blob/79fa9d85cb4510b05c2657bd7ec8a6a2cb266dc5/ports/curl/vcpkg.json#L17

Zlib updated the install version and link to 1.2.13, so now the older version 404s.

[BillyONeal]

We shouldn't need to explicitly list all transitive dependencies with vcpkg, correct?

If you want to change the version of a transitive dependency to be different than what is current as of your baseline selection, it needs to be explicitly named. (The whole point of baselines is to make it so that most of the time you don't have to name all transitive dependencies)