envoy: remove remaining nix store references from deps

To do this, this commit does several things:

* Move the set-interpreter patching to outside the fixed-output
  derivation
* Patch base_pip3/BUILD.bazel, which ends up getting Python's full path
* Drop local_jdk, which contains symlinks to our jdk input
* Drop bazel_gazelle_go_repository_tools, which contains built artifacts
  using our go

...and updates the FOD hash to match. Checked that this appears to
remove the currently obvious FOD problems by checking out an older
nixpkgs commit and applying this on top, and verifying that the FOD hash
doesn't change between that older glibc and the current tip-of-tree.

This also disables tcmalloc on ARM because I couldn't get this to build
properly otherwise.

pkgs/servers/http/envoy/default.nix

@@ -1,5 +1,6 @@
 { lib
 , bazel_5
+, bazel-gazelle
 , buildBazelPackage
 , fetchFromGitHub
 , stdenv
@@ -48,6 +49,7 @@ buildBazelPackage rec {
   postPatch = ''
     sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch
     sed -i '/javabase=/d' .bazelrc
+    sed -i '/"-Werror"/d' bazel/envoy_internal.bzl
 
     # Use system Python.
     sed -i -e '/python_interpreter_target =/d' -e '/@python3_10/d' bazel/python_dependencies.bzl
@@ -81,8 +83,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "0y3gpvx148bnn6kljdvkg99m681vw39l0avrhvncbf62hvpifqkw";
-      aarch64-linux = "0lln5mdlskahz5hb4w268ys2ksy3051drrwlhracmk4i7rpm7fq3";
+      x86_64-linux = "10f1lcn8pynqcj2hlz100zbpmawvn0f2hwpcw3m9v6v3fcs2l6pr";
+      aarch64-linux = "1na7gna9563mm1y7sy34fh64f1kxz151xn26zigbi9amwcpjbav6";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
@@ -91,20 +93,18 @@ buildBazelPackage rec {
       find $bazelOut/external -name requirements.bzl | while read requirements; do
         sed -i '/# Generated from /d' "$requirements"
       done
-      find $bazelOut/external -type f -executable | while read execbin; do
-        file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue
-        patchelf \
-          --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
-          "$execbin"
-      done
 
       # Remove references to paths in the Nix store.
       sed -i \
         -e 's,${python3},__NIXPYTHON__,' \
         -e 's,${stdenv.shellPackage},__NIXSHELL__,' \
         $bazelOut/external/com_github_luajit_luajit/build.py \
-        $bazelOut/external/local_config_sh/BUILD
+        $bazelOut/external/local_config_sh/BUILD \
+        $bazelOut/external/base_pip3/BUILD.bazel
+
       rm -r $bazelOut/external/go_sdk
+      rm -r $bazelOut/external/local_jdk
+      rm -r $bazelOut/external/bazel_gazelle_go_repository_tools/bin
 
       # Remove Unix timestamps from go cache.
       rm -rf $bazelOut/external/bazel_gazelle_go_repository_cache/{gocache,pkg/mod/cache,pkg/sumdb}
@@ -115,6 +115,16 @@ buildBazelPackage rec {
     dontUseGnConfigure = true;
     dontUseNinjaInstall = true;
     preConfigure = ''
+      # Make executables work, for the most part.
+      find $bazelOut/external -type f -executable | while read execbin; do
+        file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue
+        patchelf \
+          --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+          "$execbin"
+      done
+
+      ln -s ${bazel-gazelle}/bin $bazelOut/external/bazel_gazelle_go_repository_tools/bin
+
       sed -i 's,#!/usr/bin/env bash,#!${stdenv.shell},' $bazelOut/external/rules_foreign_cc/foreign_cc/private/framework/toolchains/linux_commands.bzl
 
       # Add paths to Nix store back.
@@ -122,7 +132,8 @@ buildBazelPackage rec {
         -e 's,__NIXPYTHON__,${python3},' \
         -e 's,__NIXSHELL__,${stdenv.shellPackage},' \
         $bazelOut/external/com_github_luajit_luajit/build.py \
-        $bazelOut/external/local_config_sh/BUILD
+        $bazelOut/external/local_config_sh/BUILD \
+        $bazelOut/external/base_pip3/BUILD.bazel
     '';
     installPhase = ''
       install -Dm0755 bazel-bin/source/exe/envoy-static $out/bin/envoy
@@ -137,10 +148,7 @@ buildBazelPackage rec {
     "-c opt"
     "--spawn_strategy=standalone"
     "--noexperimental_strict_action_env"
-    "--cxxopt=-Wno-maybe-uninitialized"
-    "--cxxopt=-Wno-uninitialized"
-    "--cxxopt=-Wno-error=type-limits"
-    "--cxxopt=-Wno-error=range-loop-construct"
+    "--cxxopt=-Wno-error"
 
     # Force use of system Java.
     "--extra_toolchains=@local_jdk//:all"
@@ -148,7 +156,12 @@ buildBazelPackage rec {
     "--tool_java_runtime_version=local_jdk"
 
     "--define=wasm=${wasmRuntime}"
-  ];
+  ] ++ (lib.optionals stdenv.isAarch64 [
+    # external/com_github_google_tcmalloc/tcmalloc/internal/percpu_tcmalloc.h:611:9: error: expected ':' or '::' before '[' token
+    #   611 |       : [end_ptr] "=&r"(end_ptr), [cpu_id] "=&r"(cpu_id),
+    #       |         ^
+    "--define=tcmalloc=disabled"
+  ]);
   bazelFetchFlags = [
     "--define=wasm=${wasmRuntime}"
   ];