bazel: fix python stub paths

[picnoir]

Motivation for this change

Since the 0.21 upgrade, the host $PATH is not forwarded anymore by default to the sandboxes in charge to realize Bazel actions. This default change broke the py_binary rule among other things.

Every python binary is wrapped in a stub in charge to setup the execution environment. Currently, this stub's shebang points to a /usr/bin/env python which cannot be resolved with the current $PATH. This results in breaking any build pipeline requiring the use of python at some point. On top of the incorrect shebang, the stub template is unable to find the actual python binary using SearchPath.

This PR fixes those two things by re-writing the stub template shebang to the actual python binary and by substituting the faulty default python binary lookup to the right one.

Notes:

• The patch file instead of a substitute-in-place is intentional: we probably want to build to fail if this part of the template logic changed.
• The default python path can be overridden using the --python_path bazel flag. This patch does not break this behaviour.
• A test exposing the bug is also provided. (This test has been written by @Profpatsch, thanks :) )

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

[Profpatsch]

Pushed a slight correction:

• fix the missing callPackage (meta is not evaluated by default, so the missing symbol did not throw an error).
• Rename the test file to use more conventional -.
• allow substitutes in runLocal

[Profpatsch]

@GrahamcOfBorg build bazel.tests

[Profpatsch]

Awesomesauce. Next step is to add tests for all other built-in languages as well. I’ll open an issue for that.

[abbradar]

@NinjaTrappeur I encountered problems with this patch and Python 2 as part of #64716 and partially reverted the fix (we now use PATH for finding Python to run). Strangely this didn't break anything, tests run fine and packages build. Can you check out 9ed16da? What do I miss?

[Profpatsch]

@abbradar Can you open an issue and ping me in it?