Library lzma has vulnerability CVE-2020-22916

[github-actions]

https://nvd.nist.gov/vuln/detail/CVE-2020-22916

An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of crafted file.

[Smjert]

It's unclear where the issue resides, see: tukaani-project/xz#61
That being said, better be safe than sorry and update lzma.

EDIT: note that upstream is unclear if the issue has been solved by a more recent version, so while we can update the library, we should NOT close this issue until there is confirmation from upstream.

[Smjert]

Closing since upstream is disputing this; we also updated anyway and the new version is not reporting this issue.