fix: Use get_tool_for_action and absolutize sysroot path

[tsudol-plaid]

The compiler executable path provided by cc_toolchain.compiler_executable does not necessarily point to the actual compiler path. For example, on MacOS it is external/llvm+/toolchain/gcc, which does not actually exist.
Instead, the real compiler needs to be discovered via cc_common.get_tool_for_action. This gives the real compiler path external/llvm++_repo_rules+llvm-toolchain-minimal-22.1.3-darwin-arm64/bin/clang.

Additionally, the --sysroot flag needs to be passed in to the compiler so that it can find system headers. Like the CC and CXX env vars, the given sysroot path is relative to the Bazel workspace root, so it needs to be absolutized before it can be added to CFLAGS.
This should be perfectly safe, because the sysroot directory is included in the toolchain's all_files list, so it will be present in the Bazel workspace.

This is a follow-on from #1108.

Test plan

• Manual testing; please provide instructions so we can reproduce:

I am unsure how to test this, because it seems to require MacOS and its weird C++ setup.