Address review comments

- Move download-artifacts from .claude/ci/ to tooling/bin/ and update
  all references in documentation.
- Rewrite download-artifacts into PHP and use curl multi handles. Time
  to find the datadog-setup.php from a commit drops from ~35 s to ~10 s.
- Delete build-slim-package.py; its functionality is now more or less
  covered by build-debug-artifact, the difference being in that
  build-debug-artifacts builds, well, debug artifacts, unlike CI.
- Switch build-debug-artifact from bookworm to centos-7 images for GLIBC
  2.17 compatibility with all weblog base images.
- Use debug build profiles (CFLAGS=-O0, cargo dev profile, cmake Debug)
  instead of release/RelWithDebInfo.
- Add Rust appsec helper build support to build-debug-artifact.
- Resolve libddwaf commit on the host to avoid git failures in
  worktrees; pass LIBDDWAF_GIT_COMMIT to cmake in
  build-appsec-helper.sh.
- Suppress git safe.directory errors in build-appsec-helper-rust.sh.
- Simplify system-tests.md: remove stub file instructions, point to
  "Slim package with debug binaries" section in building-locally.md.
- Simplify github-actions-profiler.md: note that bookworm images already
  include the parallel PECL extension.
- Add "Slim package with debug binaries" section to building-locally.md
  documenting build-debug-artifact usage.

Author: cataphract

.claude/ci/benchmarks.md

@@ -129,7 +129,7 @@ Fastest when you don't need to modify the extension itself. See
 
 ```bash
 # Download the "compile extension: debug" artifact for PHP 8.2
-.claude/ci/download-artifacts \
+tooling/bin/download-artifacts \
     --job-name "compile extension: debug [8.2, amd64]" \
     -o /tmp/bench-ext