xgboost: add build-xgboost.yml for riscv64 wheels - #408

xgboost's Python package is a scikit-build-core project whose CMakeLists
builds libxgboost.so from the sibling C++ tree and installs it into
xgboost/lib. `wheel.py-api = "py3"` makes that a single py3-none-<plat>
wheel, so the port is upstream's macOS cibuildwheel job
(ops/pipeline/build-python-wheels-macos.sh) narrowed to
manylinux_riscv64, with one deviation:

- upstream's committed pyproject.toml is the CUDA variant and requires
  nvidia-nccl-cu13 on Linux, which does not exist for riscv64. The
  workflow regenerates it with `ops/script/pypi_variants.py
  --use-suffix=na --require-nccl-dep=na`, which is the NCCL-free
  `xgboost` upstream already publishes for macOS and win_arm64.

Tests are upstream's `cpu-arm64` suite from
ops/pipeline/test-python-wheel.sh, unchanged. scikit-learn is compiled
in-container rather than dropped: xgboost.testing importorskips
sklearn.datasets at module level, so without it every test module skips
wholesale and the run proves nothing. numpy/scipy/pandas come from the
registry as wheels via PIP_ONLY_BINARY, scoped to the test phase.

The wheel vendors the image's libgomp.so.1 (auditwheel), hence the
gpl_sources job.

Validated on aarch64 in the same Rocky 10 manylinux image family: the
wheel builds in 14m CPU, carries xgboost/lib/libxgboost.so plus
xgboost.libs/libgomp-*.so.1.0.0 and dist-info/licenses/LICENSE, and the
suite passes 34/34 against a cibuildwheel-shaped staged test cwd. A
cmake configure under linux/riscv64 in manylinux_2_39_riscv64 succeeds
(gcc 14.3.1, OpenMP 4.5, SSE2 correctly not selected).

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

scikit-learn was deliberately absent from PIP_ONLY_BINARY because no riscv64
wheel existed, so pip fell back to its sdist and spent about 22 minutes of a
63 minute job compiling it in-container. #339 is merged and publishing 1.9.0,
which is the version pip resolves to here, so adding it to the list forces the
registry wheel and removes that compile.

The test phase will fail until the publish lands: with scikit-learn in
PIP_ONLY_BINARY there is no sdist fallback left, and xgboost.testing
importorskips sklearn.datasets at module level, so the suite needs it.