Hermetic builds

[alexey-milovidov]

Changelog category (leave one):

• Build/Testing/Packaging Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
Hermetic builds: use fixed version of libc and make sure that no source or binary files from the host OS are using during build. This closes #27133. This closes #21435. This closes #30462.

Detailed description / Documentation draft:
See also #24371 and #22113.

[azat]

Great! So now #29594 can be reverted. @alexey-milovidov can you also revert it within this PR?

[alexey-milovidov]

Ok, will do.

To finish this PR:

• figure out how to disable hermetic builds for gcc and for shared build;
• maybe remove the issue that protobuf is compiled twice;
• look at the strange result of the compatibility check.

[pkit]

@alexey-milovidov
Err, doesn't close #30462 at all.
Still fails to build on glibc 2.35 using current master 6531ff7
See #43633

[Algunenano]

Still fails to build on glibc 2.35 using current master 6531ff7

Are you sure it's the same problem? The hermetic build works fine for me with an even newer glibc:

$ pacman -Q glibc
glibc 2.36-6

[alexey-milovidov]

We don't access the system's libc during build time. So, the build is hermetic in this regard.
But the built binary still has to access the target machine's libc library at runtime.