Resolve need for noincompatible_sandbox_hermetic_tmp

[Matthew-Benson]

The Fish shell build currently needs the flag --noincompatible_sandbox_hermetic_tmp, otherwise the share and etc directories of data dirs in the cmake rule are broken because fish build/install is making symlinks that are broken. See tracking issue: bazel-contrib/rules_foreign_cc#1129

There may be a fix coming in bazel 7.2, but there are some workarounds suggested in the issue. Our general improvements to the toolchain may resolve the issue too.