[CMake] Link only what is used: drop unused explicit library deps

[guitargeek]

Address #20731 by removing explicitly-linked-but-unused libraries reported by ldd -u. The recurring offenders all came from foundational libraries exporting internal-only dependencies through their PUBLIC link interface (CMake DEPENDENCIES), so every consumer inherited them. These are now PRIVATE (CMake LIBRARIES), and genuinely-spurious links dropped:

• RIO: Thread -> PRIVATE (TFilePrefetch only holds a TThread* member)
• Tree: Imt/Net/MathCore -> PRIVATE, declares its own Thread
  (RIO stays PUBLIC: TBufferSQL/TTreeCache derive from RIO types)
• RHTTP/HistPainter/RooStats/RooFitMore/RCsg: internal deps -> PRIVATE
• Hbook/Spectrum/HistFactory: spurious Matrix/Foam removed
• ntuple_merger/stressRooFit tests: declare the deps they actually use

RIO -> Thread alone cuts Thread over-linking from 62 reports to 2; in total the tree drops from 510 reports (77 libs) to 422 (69), and every library still links cleanly under -Wl, --no-undefined.

This closes #20731: the remaining reports are not over-linking and PUBLIC/PRIVATE cannot remove them. They are either inline-header dependencies (e.g. Tree using TMath: a real compile dependency with no exported symbol, which ldd -u mis-flags) or deliberate public API (Hist exposes TVectorD/TMatrixD; TMessage derives from TBufferFile).

Closes #20731.

🤖 Done with the help of AI.

[github-actions]

Test Results

     9 files       9 suites   1d 13h 23m 13s ⏱️
 3 801 tests  3 801 ✅ 0 💤 0 ❌
31 208 runs  31 208 ✅ 0 💤 0 ❌

Results for commit 0f32839.

♻️ This comment has been updated with latest results.

[dpiparo]

Added the "clean build" label and restarted, this is perhaps necessary to better understand any failure since the complication of pre-existing artifacts is lifted.

[guitargeek]

Looks like it still doesn't work, probably because my local configuration is very different from the default or what is run on the CI. Will investigate!

[ferdymercury]

In net/davix/CMakeLists.txt

I think there was a real dependency on Thread that was picked up via RIO public.
src/TDavixFile.cxx:static TMutex createLock;

since RIO now links privately to Thread, one would need to add Thread as PRIVATE link-lib of Davix's target.