Replace https://github.com/xi2/xz due to no license

[korpa]

While working on #117 I discovered that the xz lib used has no license. We should replace it.

Maybe https://pkg.go.dev/github.com/ulikunitz/xz is a good fit.

[marcosnils]

SGTM!