ci: Add opensuse-leap 15.4, skip TLS on 15.3, test --without-libxml2

lcitool recently added support for Leap 15.4; meanwhile, Leap 15.3 has
a version of nbdkit that tries to use @nbdkit,SYSTEM as the TLS
priority which then crashes in gnutls.  Explicitly testing our
--without-gnutls configure coverage on that platform is thus a good
idea; this required tweaking build.sh to learn some more variables,
and reordering to put CONFIGURE_OPTS (which the user can override at
pipeline time) after our hard-coded CONFIG_ARGS.  While at it, we can
also test our --without-libxml2 coverage on Fedora Rawhide.

Thanks: Daniel P. Berrangé <berrange@redhat.com>