@nuclearsandwich I removed the exported dependency on cmake to match what we do for tinyxml2

I think removing this is correct. If memory serves the reason I added it was because the vendor package runs cmake code at its run time (downstream build time) and so packages which depend on it require cmake to be in their build time dependencies.

But in order to try and avoid cmake at runtime I think it's permissible to assume that anything which depends on the vendor package rather than tinyxml2 directly already needs cmake at build time.