Improve Zig cache handling

[aherrmann]

As of #253 the Zig cache is stored in an absolute path that is not managed by Bazel and is persisted between build actions and Bazel builds. This requires dedicated Bazel configuration (--sandbox_add_mount_pair) to pass the path through the sandbox. This is not strictly hermetic as the previous state of the cache can impact a following build, and as the cache may be persisted across Zig SDK updates or other actions that may trigger build failures due to incompatible changes in the cache treatment.

Consider alternative options to manage the Zig cache, e.g. uber/hermetic_cc_toolchain#83, or a persistent worker as described in #87. Take local builds, CI builds, and remote execution builds, as well as Zig SDK, Bazel, and rule set version updates into account.