[librats] Add new librats 2.0.9

[Alexey Kasyanchuk (DEgITx)]

Adds a new port for librats — an MIT-licensed C++17 peer-to-peer networking library: encrypted transport (Noise_XX), peer discovery (Kademlia DHT, mDNS), NAT traversal (STUN/UPnP/NAT-PMP), GossipSub pub/sub, file transfer, and an optional BitTorrent stack. It has no external dependencies beyond platform sockets and threads.

• Changes comply with the maintainer guide.
• The packaged project is mature and ready for broad sharing with vcpkg users
  • Has a release at least 6 months old or 6 months of demonstrated public development
  • Is an official component of something else meeting that criteria
  • Some other reason (please explain)
• The packaged project shows strong association with the chosen port name. Check this box if at least one of the following criteria is met:
  • The project is in Repology: https://repology.org/project/librats/versions
  • The project is amongst the first web search results for "librats" or "librats C++". Include a screenshot of the search engine results in the PR.
  • The port name follows the 'GitHubOrg-GitHubRepo' form or equivalent Owner-Project form.
• Optional dependencies of the build are all controlled by the port. A dependency is controlled if it is declared an unconditional dependency in vcpkg.json, or explicitly disabled through patches or build system arguments such as CMAKE_DISABLE_FIND_PACKAGE_Xxx or VCPKG_LOCK_FIND_PACKAGE
• The versioning scheme in vcpkg.json matches what upstream says.
• The license declaration in vcpkg.json matches what upstream says.
• The installed as the "copyright" file matches what upstream says.
• The source code of the component installed comes from an authoritative source.
• The generated "usage text" is brief and accurate. See adding-usage for context. Don't add a usage file if the automatically generated usage is correct.
• The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
• Exactly one version is added in each modified versions file.

[Alexey Kasyanchuk (DEgITx)]

@microsoft-github-policy-service agree

[Billy O'Neal (BillyONeal)]

Thanks for the new port submission! Drafted due to build failures. GPT 5.6 additionally reports:

• Windows ARM64 is currently declared supported but fails to compile because __cpuid is used unconditionally for Windows. Either fix this upstream and update the port, or accurately constrain "supports" so unsupported Windows ARM architectures are excluded.
• The source compiles embedded copies of curve25519-donna, poly1305-donna, Southern Storm cryptographic implementations, and (on older Android API levels) ifaddrs-android. The maintainer guide prohibits vendored dependencies; these need to be replaced with separately packaged dependencies or otherwise resolved with the maintainers.

I understand that a lot of crypto space stuff might have vendored "constants" which may make this reasonable but insofar as is possible anything that would break if 2 ports do this needs to be sucked out.

• "license": "MIT" and the installed copyright file do not cover the BSD-3-Clause curve25519-donna code, the BSD-style ifaddrs-android code, or the separate notices embedded in other cryptographic sources and installed headers. Correct the SPDX expression and install all required notices.
• bindings adds the C API but is enabled by default. Default features must not add APIs; remove it from default-features.
• Public headers use includes such as "util/rats_export.h", so a consumer given only <triplet>/include cannot compile <librats/node/node.h>. Make installed headers self-contained from the triplet include root (for example, consistently use librats/... includes).

This last thing is not absolute but does mean the port is very difficult to use for downstream build systems that don't support complicated bindings, like MSBuild. If the upstream library does not care and it would require touching every header or something like that it's acceptable if this part is skipped but it would be nice to see that explicitly attempted.

[Alexey Kasyanchuk (DEgITx)]

Billy O'Neal (@BillyONeal), Thanks for the detailed review :) . Upstream fixes are in and the port is updated to version 2.0.9:

1. Windows ARM64 build restored — fixed __cpuid problem
2. License / copyright — license is now MIT AND BSD-3-Clause AND BSD-2-Clause AND BSD-1-Clause, and the port installs the full notice set through vcpkg_install_copyright: upstream LICENSE plus curve25519-donna, poly1305-donna, noise-c and ifaddrs-android, with a COMMENT mapping each notice to the sources it covers.
3. bindings default feature — removed from default-features; the C API is opt-in now.