As far as I could see, springs source tarball includes a copy of lua, md5 and 7zip (have I missed anything? Keep in mind that I've yet to check if springs actually links against these libraries).
I'd have to check myself, at the moment I'm writing this post on top of my mind
Before I start diving into the code, can any of these libraries be replaced with the system version?
no, as far as I remember, all those libraries link to streflop ( see below )
If not, are you using particular patches that require the use of static libraries?
In order to ensure that floating point calculations provide consistent results on different operative systems and different architectures, in certain critical parts of the code and relative libraries used there, Spring makes use of the streflop library, which replaces some mathematical functions in C/C++ code with it's own version.
if I recall correctly, all the libraries you mentioned contain such special linking.
Removing streflop link would result in broken networking and broken replay watching with other clients
Did you attempt to get these patches included in the upstream version?
I am not aware of any attempts for such, and I think given the very specific use case, it would be unnecessary.