Fix hermetic toolchain

[j2kun]

Fixes #3047

A simplification and borrowing parts of #3045

Change summary:

1. Bump hermetic llvm to a version that has openmp
2. Patch openfhe locally to pull from the hermetic llvm's openmp
3. Bump fmt to a working version
4. Move zlib to MODULE.bazel to avoid the need to patch
5. Patch bison same as LLM-generated hermetic llvm #3045
6. Use @hermetic_llvm//openmp:libomp in the places in HEIR that need openmp
7. Enable BAZEL_TRACK_SOURCE_DIRECTORIES to silence some warnings introduced by hermetic llvm (this will go away by default in bazel 9, but we're still on bazel 8)
8. Add -no-pie for golang tests
9. Enable remote build execution and caching with buildbuddy, but don't yet update main CI workflow to use it.

[asraa]

quick questions

[j2kun]

The macos build ran out of memory, so this suggests the openmp was not blocking the build. I think buildbuddy will reduce RAM needs for the macos CI when it's working