third_party:heimdal_build: search the replacement headers first

third_party/heimdal_build/ holds Samba's replacements for headers that also exist under third_party/heimdal/: crypto-headers.h, roken.h, vis.h, parse.h, asn1parse.h and others. Whether a replacement is actually used depends on -Ithird_party/heimdal_build preceding the heimdal directory that carries the same header name.

That order is decided by build_includes() in buildtools/wafsamba/samba_deps.py, which iterates an unordered set of target names and appends each dependency's own directory after the directories that dependency declares in includes=. Nine heimdal targets declare ../heimdal/include, so whichever one the set happens to yield first decides whether the tree builds. On sparc64 it comes out as heimdal/include first, the vendored crypto-headers.h is used instead of the replacement, and the build fails:

third_party/heimdal/include/crypto-headers.h:5:2: error: #error "need config.h"

That copy requires PACKAGE_NAME, which nothing in a Samba build defines, so it can never be compiled successfully here.

This change puts the declaring directory first in the includes= list of the HEIMDAL_* wrappers, so the replacements win whatever order the set yields.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=16229

Verification

On amd64 against master, with the PYTHONHASHSEED guard at buildtools/wafsamba/wscript:18 relaxed and the dependency cache bin/c4che/sambadeps removed between runs:

• PYTHONHASHSEED=5 ./buildtools/bin/waf build -j20 fails on master with the error above, in WDC_SAMBA4, and that is the only distinct error in the build.
• Of the 1025 targets that have both directories on their include path, the number searching heimdal/include first is 891 at seed 5 and 0 at seeds 1, 2, 4, 8 and 9. With this change it is 0 at every seed from 1 to 12.
• With this change PYTHONHASHSEED=5 builds to completion, a rebuild comes back a no-op, and both source4/kdc/wdc-samba4.c and source4/kdc/sdb_to_hdb.c are built.

Not run through autobuild. I do not have access, so a CI run would be welcome.

No test suite change: the failure mode is the order in which the build system emits -I flags, which no runtime test can observe. It can be regression tested by generating task lists under several PYTHONHASHSEED values and asserting that third_party/heimdal_build precedes third_party/heimdal for every target that has both, which is what I did to produce the numbers above. I am happy to turn that into a check under buildtools/ if you would like one.

There is a companion merge request against buildtools/wafsamba/samba_deps.py for the underlying set-ordering problem, bug 15080. This MR stands alone and does not depend on it.

Checklist

• Commits have Signed-off-by: with name/author being identical to the commit author
• (optional) This MR is just one part towards a larger feature.
• (optional, if backport required) Bugzilla bug filed and BUG: tag added
• Test suite updated with functionality tests
• Test suite updated with negative tests
• Documentation updated
• CI timeout is 3h or higher (see Settings/CICD/General pipelines/ Timeout)

Reviewer's checklist:

• There is a test suite reasonably covering new functionality or modifications
• Function naming, parameters, return values, types, etc., are consistent and according to README.Coding.md
• This feature/change has adequate documentation added
• No obvious mistakes in the code