Build statically linked Linux binaries in CI

[cknitt]

This PR provides statically linked Linux binaries to resolve all those glibc compatibility issues once and for all. 😃

This is achieved by

1. Performing the Linux build in an Alpine Linux Docker container. Alpine uses musl libc which is a glibc replacement that can be statically linked.
2. Adding the flags -cclib -static -cclib -no-pie to the dune files for the executables built with OCaml.
3. Adding LDFLAGS=-static to the build for the ninja executable.

(See https://ocamlpro.com/blog/2021_09_02_generating_static_and_portable_executables_with_ocaml for more information.)

The Docker image used is in the GitHub Container Registry as ghcr.io/rescript-lang/rescript-ci-build. Sources are at https://github.com/rescript-lang/docker-rescript-ci-build.

Docker support in Github actions has many limitations. While it is possible to run a single build step in Docker, it is then run as root in the Docker container, resulting in permission issues with the generated files. The only approach I finally got to work was to build the compiler and ninja binaries in a separate job and upload them as artifacts, to be used by the for the Linux platform in the existing build job (in place of building them from source there).

This additional job for building the static binaries needs to complete before the normal build job (for all platforms) can be started. It is fairly quick though (~2 minutes) as all dependencies are already preinstalled in the Docker container used. Still, this unfortunately increases the total execution time for the CI workflow.

I also had to make a cleaner separation in the Makefile and scripts between the dune build and the subsequent stdlib build/tests. These should not use dune exec to avoid triggering a rebuild of the executables with different settings. (Also dune exec at least checks for changes and so comes with some performance cost anyway.)

The generated binaries were tested successfully on NixOS, see #5694 (comment).

[cristianoc]

On linux, do we still need the steps for ocaml and opam, given that the compiler has been built already?

[cknitt]

On linux, do we still need the steps for ocaml and opam, given that the compiler has been built already?

Yes, for several reasons. From what I remember, one was ocamldep being needed for the stdlib build, then there is dune for the format check and also reanalyze for the tests.