Sandbox libxml2 and switch clang to zstd compression

When trying to execute clang on a very very fresh Debian image, it can't
find libxml2.  Sandbox that too.

While we are here, zstd images extract faster than xz.  Switch over.

Change-Id: Ia196ae49223b488f5eabe28b67e6f274b3072795
Signed-off-by: Austin Schuh <austin.linux@gmail.com>
diff --git a/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl b/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl
index 6be2fbb..e575191 100644
--- a/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl
+++ b/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl
@@ -32,6 +32,7 @@
 
 # Call the C++ compiler.
 if [[ -f %{toolchain_path_prefix}bin/clang ]]; then
+  export LD_LIBRARY_PATH=external/llvm_toolchain/llvm/lib/
   exec %{toolchain_path_prefix}bin/clang "$@"
 elif [[ "${BASH_SOURCE[0]}" == "/"* ]]; then
   # Some consumers of `CcToolchainConfigInfo` (e.g. `cmake` from rules_foreign_cc)
@@ -41,6 +42,7 @@
   # This script is at _execroot_/external/_repo_name_/bin/clang_wrapper.sh
   execroot_path="${BASH_SOURCE[0]%/*/*/*/*}"
   clang="${execroot_path}/%{toolchain_path_prefix}bin/clang"
+  export LD_LIBRARY_PATH="${execroot_path}/external/llvm_toolchain/llvm/lib/"
   exec "${clang}" "${@}"
 else
   >&2 echo "ERROR: could not find clang; PWD=\"$(pwd)\"; PATH=\"${PATH}\"."