Lower linux glibc requirement from 2.31 to 2.28

In componentize-py Joel's building custom wasi-sdk binaries for more
Linux compat which is what maturin, the build tool use there, desires. I
don't think there's a concrete reason to have a higher Linux version
here, so let's lower it in wasi-sdk itself.

This commit switches the build container from Ubuntu 20.04 (glibc 2.31)
to AlmaLinux 8 (glibc 2.28). The AlmaLinux container is what Wasmtime
uses, for example, and has supported security updates to 2029 and is I
believe intended to be used for purposes such as this.

ci/docker/Dockerfile

@@ -1,40 +1,34 @@
 # Use a relatively old/stable distro here to maximize the supported platforms
 # and avoid depending on more recent version of, say, libc.
-# Here we choose Ubuntu 20.04.
+# Here we choose AlmaLinux 8
 
-FROM ubuntu:20.04
+FROM almalinux:8
 
 # Various build tooling and such necessary to build LLVM and a wasi-sysroot
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends \
-  ccache \
+RUN dnf install -y \
   curl \
   ca-certificates \
-  build-essential \
   clang \
   python3 \
   git \
   unzip \
-  xz-utils
+  cmake
 
-# Install a more recent version of CMake than what 18.04 has since that's what
-# LLVM requires.
 RUN ARCH=$(uname -m) \
-  && curl -sSLO https://github.com/Kitware/CMake/releases/download/v3.29.5/cmake-3.29.5-linux-${ARCH}.tar.gz \
-  && tar xf cmake-3.29.5-linux-${ARCH}.tar.gz \
-  && rm cmake-3.29.5-linux-${ARCH}.tar.gz \
-  && mkdir -p /opt \
-  && mv cmake-3.29.5-linux-${ARCH} /opt/cmake
+  && curl -sSLO https://github.com/ccache/ccache/releases/download/v4.12.1/ccache-4.12.1-linux-${ARCH}.tar.xz \
+  && tar -xf ccache-4.12.1-linux-${ARCH}.tar.xz \
+  && rm ccache-4.12.1-linux-${ARCH}.tar.xz \
+  && mv ccache-4.12.1-linux-${ARCH} /opt/ccache
 
-ENV PATH /opt/cmake/bin:$PATH
+ENV PATH /opt/ccache:$PATH
 
-# As with CMake install a later version of Ninja than waht 18.04 has.
+# AlmaLinux 8 doesn't seem to have ninja, so install it manually.
 RUN ARCH=$(uname -m) \
   && if [ "$ARCH" = "aarch64"  ]; then SUFFIX=-aarch64; fi \
   && curl -sSL -o ninja.zip https://github.com/ninja-build/ninja/releases/download/v1.12.1/ninja-linux${SUFFIX}.zip \
   && unzip ninja.zip \
   && rm *.zip \
-  && mv ninja /opt/cmake/bin
+  && mv ninja /opt/ccache
 
 # Tell programs to cache in a location that both isn't a `--volume` mounted root
 # and isn't `/root` in the container as that won't be writable during the build.