zig launcher: replace shell wrappers with a binary

Until now we needed to maintain two versions of the zig launcher: one
for Windows and one for everything else. This was problematic for two
reasons:
1. I do not know powershell and thus keep breaking the Windows wrapper
   all the time (see git history of Fabian fixing stuff that I broke).
2. This makes bazel-zig-cc dependent on the system shell, making it not
   really hermetic. So the recently added
   `--experimental_use_hermetic_linux_sandbox` does not work with
   bazel-zig-cc, unless we bind-mount a bunch of stuff: `/usr`, `/bin`,
   `/lib`, `/usr/lib:/lib`, `/usr/lib64:/lib64` and `/proc`.

Switching to a Zig-based wrapper solves both issues, and we can do this:

    bazel build "$@" \
        --experimental_use_hermetic_linux_sandbox \
        --sandbox_add_mount_pair=/proc \
        <...>

Zig itself still depends on `/proc` for `/proc/self/exe`, so we need to
keep that. I will look into reducing even that dependency separately.

Not all is nice and shiny though: this commit replaces ~80 LOC worth of
shell scripts wrappers with a singe ~300 LOC zig program, which is
arguably harder to understand. However, it is easier to change, at least
for me, because it's a single file with unit tests! Most importantly,
the gnarly code (which resolves paths and sets environment variables) is
cross-platform.

Thanks to Fabian Hahn for testing this on Windows and pointing out
errors.

ci/test

@@ -1,16 +1,28 @@
 #!/usr/bin/env bash
-set -euo pipefail
+set -xeuo pipefail
 
+BAZEL_ZIG_CC_CACHE_PREFIX=${BAZEL_ZIG_CC_CACHE_PREFIX:-/tmp/bazel-zig-cc}
+mkdir -p "${BAZEL_ZIG_CC_CACHE_PREFIX}"
+
+# check a very hermetic setup with a single target. Re-building all of
+# them takes a long time, so using only one. If we ever decide to build all
+# targets, we will need to exclude Go, since go dynamically links to glibc on
+# linux.
+bazel build "$@" \
+    --experimental_use_hermetic_linux_sandbox \
+    --sandbox_add_mount_pair=/proc \
+    //test/c:which_libc_linux_amd64_gnu.2.19
+
+# then test everything else with the standard sandbox
 bazel test "$@" ...
 
-# /tmp/bazel-zig-cc should be empty for the test below to be valid.
-# This test ensures that github.com/ziglang/zig/issues/13050 does not
-# regress
-find /tmp/bazel-zig-cc -name mutex_destructor.o -execdir file '{}' \; | \
+# $BAZEL_ZIG_CC_CACHE_PREFIX should be empty for the test below to be valid.
+# Ensure that github.com/ziglang/zig/issues/13050 does not regress
+find "$BAZEL_ZIG_CC_CACHE_PREFIX" -name mutex_destructor.o -execdir file '{}' \; | \
     sort | uniq -c | sort -rn > /tmp/got_cache
 
 diff -u ci/testdata/want_cache /tmp/got_cache || {
     >&2 echo "ERROR: unexpected artifacts."
-    >&2 echo "Was /tmp/bazel-zig-cc empty before the test?"
+    >&2 echo "Was $BAZEL_ZIG_CC_CACHE_PREFIX empty before the test?"
     exit 1
 }