The x-checker-data field in a flatpak manifest can be used together with
flatpak-external-data-checker[0] to help maintain the dependency list.

The utility has several backends including a generic solution for
scraping and parsing of websites. Instead of using that this uses
anitya[1] as a backend. Anitya is Fedora-hosted service tracking
releases of various projects, taking away the need to match the various
version patterns across projects in the manifest.

The change required some changes to links to existing sources due to
some reasons: availability upstream, change in upstream (url, forge, tar
compression). Affected modules are:

- exiv2
  > from: https://exiv2.org/builds/exiv2-0.27.5-Source.tar.gz
  > to  :
https://github.com/Exiv2/exiv2/releases/download/v0.27.5/exiv2-0.27.5-Source.tar.gz

- graphviz
  > from:
https://www2.graphviz.org/Packages/stable/portable_source/graphviz-2.44.1.tar.gz
  > to  :
https://gitlab.com/graphviz/graphviz/-/archive/2.44.1/graphviz-2.44.1.tar.gz

- cairo
  > from: https://www.cairographics.org/releases/cairo-1.16.0.tar.xz
  > to  :
https://gitlab.freedesktop.org/cairo/cairo/-/archive/1.16.0/cairo-1.16.0.tar.gz

- libx265
  > from: 3.4 git tag
  > to  :
https://bitbucket.org/multicoreware/x265_git/downloads/x265_3.5.tar.gz
  (The 3.4 release does not have have a tarball.)

- libwmf
  > from:
https://src.fedoraproject.org/epo/pkgs/rpms/libwmf/v0.2.12.tar.gz/sha512/9280851e560becc91546906b911e0c59a1abd690e10680f6d94a335d66aeaec5eb12ccf2214ee7af2a15729a7b5f8b906022822399b4e2bc12c75a2d75748cab/v0.2.12.tar.gz
  > to:
https://github.com/caolanm/libwmf/archive/refs/tags/v0.2.12.tar.gz

- openexr
  > from:
https://github.com/openexr/openexr/releases/download/v2.3.0/openexr-2.3.0.tar.gz
  > to  :
https://github.com/AcademySoftwareFoundation/openexr/releases/download/v2.3.0/openexr-2.3.0.tar.gz

- lcms2
  > from:
https://src.fedoraproject.org/repo/pkgs/rpms/lcms2/lcms2-2.12.tar.gz/sha512/967e8ac9a1d1aa3be45dc82362b9bc71c555e8577441efda57dc12d0bf84ed9188460c52eb8542d399ce9ab43bd4191988ed22b254ef34c6c1877bbb935952ed/lcms2-2.12.tar.gz
  > to  :
https://github.com/mm2/Little-CMS/releases/download/lcms2.12/lcms2-2.12.tar.gz

Some sources do not have the x-checker-data set because they are usually
not developed anymore (last release over 10 years ago) or the next
version includes a major version bumb which is not a good candidate for
automation or the currently selected version is a git tag, which was not
clear to me.

OpenEXR and mypaint-brushes offer next major versions. GIMP is probably
not ready for the changes in OpenEXR and mypaint-brushes are not yet
finalized. Put their versions under constraints so that automatic PR
creation for dependency bumps can be enabled.

[0] https://github.com/flathub/flatpak-external-data-checker
[1] https://release-monitoring.org/

https://github.com/flathub/org.gimp.GIMP/pull/117