switch to SDK container for builds

[bcressey]

Issue #, if available:
#426

Description of changes:
The major change is moving the build of the "host" toolchain - C, C++, Go, and Rust compilers - into a separate container. The existing build system is still used to produce "target" binaries and libraries.

The split isn't as clean as we might wish since we're juggling some other concerns. Both Rust and Go want a C library and headers for their build, so we need to build copies of glibc and musl for that, which in turn require kernel headers.

Including the kernel headers in the SDK has the advantage of standardizing a particular kernel version for all package builds. It removes the kernel as a bottleneck in the build process, and opens the door to building alternative kernel packages.

We build Rust in the SDK since we want to ship the standard library built for the target in our images to reduce the size of Rust binaries, and therefore want tighter control over where and how the library is built.

We build Go for alignment with the other toolchains, even though it's quick to build.

The musl-based toolchain is new and is intended to support building our migration binaries, which need to be statically linked to be compatible across a wide range of image releases.

Testing done:
Built images, created AMI, launched instances. Cluster passed conformance tests.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[tjkirch]

Very impressive. I know how much work this took, and it'll be a huge improvement for us.

[tjkirch]

My approval stands, just nit/rebase comments remain above.

[jahkeup]

Looks like the build failed because there's a new tool needed:

required program 'unlz4' not found 

Can you add a command to install this package to the install steps of the buildspec in tools/infra/buildspec/thar-pr-build.yml? Note: we're using CodeBuild's ubuntu image so the package is liblz4-tool.

[jahkeup]

@bcressey scratch the comment, looks like you're switching to a more widely available gzip 👍