Use zig C++ as the compiler (hermetic build)

Enhancement

For long time, TiFlash has a complicated toolchain setup on Linux, for the following reasons:

• For production shipping, we would like glibc 2.17 compatibility (CentOS 7). This currently requires us to have a CentOS 7 build image.

• We want to produce both x86_64 images and ARM images.

There is a previous attempt at https://github.com/pingcap/tiflash/pull/7096, by using DevContainers to encapsulate all complexities inside the container.

It turns out that the DevContainers itself is too complicated to fulfill such purpose, to support both x86_64 and ARM arch.

As an alternative, we could use the zig C++ as the compiler. It comes from the zig language that provides a system-independent (hermetic) build toolchain. It means:

• We can produce glibc 2.17 production builds on any Linux distro, like Ubuntu 24, or even MacOS. This simplifies our build toolchain and CI/CD.

• We can produce both x86_64 and ARM images on a single machine. This greatly reduce the requirement of CI/CD infrastructure.

• We always build a stipulated, portable target, instead of using native as the target. This allows us to fully control what instruction set we will have in the final binary. No more compiler feature checks and host feature checks.

• No more bundle-checks in CMakeLists. This could simplify our build script. We should always use a bundled component, instead of a system-provided one, to ensure the build is hermetic.

There are Rust land code in TiFlash, which could utilize Zig C++ via https://github.com/rust-cross/cargo-zigbuild

It would also be possible that:

• Since the build is hermetic, we are expecting to use exactly the same toolchain dependencies for compiling target to Linux and MacOS. We no longer need special hacks about OpenSSLs, Apple LLVMs, etc.

Tracking tasks:

• Clang 17: Since targetting at glibc 2.17 requires zig 0.12 which bundles Clang 17. Ref https://github.com/pingcap/tiflash/issues/7193
• Compile as host target for externally invoked commands
  • protoc
  • grpc_cpp_plugin
• Invoke cargo-zigbuild instead of cargo for Rust land components
  • tiflash-proxy
  • libsymbolization
  • libprocess_metrics
• Use the zig builtin runtime libraries
  • libunwind
• Fix incorrect -march for MacOS targets
  • zlib-ng
  • TiFlash's built-in cpu_features

Start by reviewing the prior DevContainers attempt in PR 7096, the Clang 17 issue 7193, and the build configuration in CMakeLists. Then trace the listed toolchain tasks for protoc, grpc_cpp_plugin, cargo-zigbuild, libunwind, zlib-ng, and cpu_features. Done means the tracking checklist is completed and the hermetic build works for the stated Linux and macOS targets.