[libcxx] [llvm] [libc++][CI] Add hermetic Linux premerge builder (PR #226358)

[via llvm-commits]

================
@@ -28,7 +28,7 @@ jobs:
     if: github.repository_owner == 'llvm'
----------------
zeroomega wrote:

Are those buildkite's builder's configs in LLVM repo or in zorg? If so, we can take a look and see if they can be changed to be hermetic. If they are like our downstream builders that have configurations in downstream repos, then there is no way.

I would suggest to change the base docker image (linux one for now) used in current premerge queue to be hermetic. Except for potential breakages when we pull the trigger to change it, there is almost no drawbacks in the long run. In this case, we don't need to add the new docker image in this PR.

For ensure this stays hermetic. This is difficult since LLVM is an open project, anyone with the commit permission can change the docker file in the future and introduce new dependencies and put them in PATH or some other env args. I would say for now we can only rely on code review. Changes to docker/buildbot files will send notifications to owners and if there are changes that breaks the hermetic. We revert them. 

Among LLVM related teams we are actually developing LLM based tools to flag new PRs before landing. This could potentially be a use case to catch premerge hermetic breaking changes. If you are interested, we can talk about that more in the upcoming LLVM mtg.

If you are OK to change the https://github.com/llvm/llvm-project/blob/main/libcxx/utils/ci/docker/linux-builder.dockerfile to be hermetic. I can create another PR for that and change existing run-buildbot script based premerge bot to be hermetic. 

https://github.com/llvm/llvm-project/pull/226358