fix(IDX): make replica build more deterministic

[nmattia]

This includes a couple of fixes to make the replica build more deterministic.

This in theory allows anyone building //rs/replica with Bazel in the Docker image to get a bit-for-bit reproducible replica executable, and this should also improve Bazel cache hit rates.

This fixes for the following issues:

• Non-reproducible jemalloc build: the tikv-jemalloc-sys crate vendors jemalloc and builds it as part of build.rs. Unfortunately that build in not deterministic. To make it more deterministic we build jemalloc separately, which also speeds up rebuilds as the C code does not need to be rebuilt when rust versions change. We only enable this in Linux; this also includes a patch to support this in rules_rust: Fix annotations' crate.select for lists bazelbuild/rules_rust#2981

• Non-reproducible rules_rust build log: this includes a backport of a fix that disables build logs in rules_rust by default (backported because our build is not compatible with the latest rules_rust) build.rs stdout creates non-deterministic issues bazelbuild/rules_rust#2974

• Non-reproducible make & pkgconfig toolchains: some toolchains packaged by rules_foreign_cc cause build determinism issues so instead we use the ones installed in the container and remove build logs: Make and pkg-config toolchains are not reproducible bazel-contrib/rules_foreign_cc#1313

• Non-reproducible obj file generation in cc-rs: the cc-rs crate used in many C builds, including the (ASM) build of ring's crypto bits, generates object files that include the Bazel sandbox full path: Object file hash prefix creates determinism issues rust-lang/cc-rs#1271

• Non-reproducible codegen: cranelift-isle and cranelift-codegen-meta include references to source files as absolute paths that include the Bazel sandbox path: Avoid printing full file paths in cranelift generated code bytecodealliance/wasmtime#9553