Revisit boostrap tools use in builds

[msuozzo]

Currently, OSS Rebuild build tools are downloaded from mutable GCS addresses in the google-rebuild-bootstrap-tools bucket.

Ideally, we'd like to avoid incorporating prebuilt binaries like this, especially as subsequent changes to these build binaries may break the builds.

To bridge the gap, I see a few options:

1. Versioning GCS addresses
   • Pro: Locks the tool versions to immutable addresses
   • Con: A bit more complex to version
   • Con: A bit more verbose
2. Create GitHub releases for tool builds that builds could download
3. Inline build tool builds with go run
   • Pro: No intermediate builds
   • Con: Meaningful increase in build cost+latency (TODO: quantify this)
     • Although the toolchain installation cost would be amortized across the full set of binaries.
     • Could potentially cache these but, as always, there be 🐉🐉