ci: limit kernel-headers package to quictls/openssl builds

These headers are the source of endless issues, this time breaking apt
install for riscv + musl debian sid (both gcc and llvm):

```
The following packages have unmet dependencies:
 linux-headers-amd64 : Depends: linux-headers-6.6.9-amd64 (= 6.6.9-1) but it is not going to be installed
E: Unable to correct problems, you have held broken packages.
```
https://github.com/curl/curl-for-win/actions/runs/7508129730/job/20443035005#step:3:139

Since we're not using quictls/openssl by default at the moment, skip
the kernel headers package unless specifically doing a quictls build.

This doesn't fix the issue of course when building with quictls/openssl,
so probably the best workaround is to disable this insanity in
quictls/openssl by passing `no-secure-memory`. This doesn't sound good
either, but at least it works without the giant hacks their solution
requires on every platform except possibly the most basic one (linux
glibc non-cross build). Hopefully once we ever have deal with openssl
again, the above problem will get sorted out in some ways.

_ci-linux-alpine.sh

@@ -21,7 +21,9 @@ if [[ "${CW_CONFIG:-}" = *'win'* ]]; then
 elif [[ "${CW_CONFIG:-}" = *'linux'* ]]; then
   apk add --no-cache checksec-rs --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community/
   extra+=' compiler-rt libc++-static'  # for llvm
-  extra+=' linux-headers'  # for openssl 'secure-memory' feature
+  if [[ "${CW_CONFIG:-}" =~ (quictls|openssl) ]]; then
+    extra+=' linux-headers'  # for openssl 'secure-memory' feature
+  fi
   if [[ "${CW_CONFIG:-}" = *'gcc'* ]]; then
     extra+=' gcc'
   fi

_ci-linux-debian.sh

@@ -78,11 +78,13 @@ elif [[ "${CW_CONFIG:-}" = *'linux'* ]]; then
     if [[ "${CW_CONFIG:-}" = *'gcc'* ]]; then
       extra+=" libgcc${CW_GCCSUFFIX}-dev"
     fi
-    # for openssl 'secure-memory' feature
-    if [ "$(uname -m)" = 'aarch64' ]; then
-      extra+=' linux-headers-arm64'
-    elif [ "$(uname -m)" = 'x86_64' ]; then
-      extra+=' linux-headers-amd64'
+    if [[ "${CW_CONFIG:-}" =~ (quictls|openssl) ]]; then
+      # for openssl 'secure-memory' feature
+      if [ "$(uname -m)" = 'aarch64' ]; then
+        extra+=' linux-headers-arm64'
+      elif [ "$(uname -m)" = 'x86_64' ]; then
+        extra+=' linux-headers-amd64'
+      fi
     fi
   else
     # FIXME: workaround for glibc-llvm-riscv64 builds: