nix: patch bazel_7 with hardcoded bin paths (#59359)

bazel (and its community of rules) is a bit of a mess when it comes to passing around env values, including $PATH, resulting in some actions not receiving the $PATH value set via `--action_path=PATH=...` that we rely on. Bazel 6 in nixpkgs had [the following patch](https://sourcegraph.com/github.com/NixOS/nixpkgs/-/blob/pkgs/development/tools/build-managers/bazel/bazel_6/actions_path.patch) that hardcodes a set of packages to include in that case, which is currently missing from Bazel 7 in nixpkgs, so we (temporarily, hopefully) reintroduce that patch locally. 

See: NixOS/nixpkgs#262152 (comment) and NixOS/nixpkgs#94222 for some reading

I plan to move more bazel stuff out of shell.nix perhaps, into bazel.nix, as its a tad messy all-in-one

## Test plan

`bazel build //client/web/dist` is successful

dev/nix/bazel.nix

@@ -0,0 +1,52 @@
+{ nixpkgs
+, pkgs
+, bazel_7
+, lib
+, substituteAll
+, bash
+, coreutils
+, diffutils
+, file
+, findutils
+, gawk
+, gnugrep
+, gnupatch
+, gnused
+, gnutar
+, gzip
+, python3
+, unzip
+, which
+, zip
+}: {
+  bazel_7 = bazel_7.overrideAttrs (oldAttrs:
+    let
+      # yoinked from https://sourcegraph.com/github.com/NixOS/nixpkgs/-/blob/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix?L77-120
+      defaultShellUtils = [
+        bash
+        coreutils
+        diffutils
+        file
+        findutils
+        gawk
+        gnugrep
+        gnupatch
+        gnused
+        gnutar
+        gzip
+        python3
+        unzip
+        which
+        zip
+      ];
+    in
+    {
+      # https://github.com/NixOS/nixpkgs/pull/262152#issuecomment-1879053113
+      patches = (oldAttrs.patches or [ ]) ++ [
+        (substituteAll {
+          src = "${nixpkgs}/pkgs/development/tools/build-managers/bazel/bazel_6/actions_path.patch";
+          actionsPathPatch = lib.makeBinPath defaultShellUtils;
+        })
+      ];
+    });
+}

flake.nix

@@ -19,13 +19,14 @@
     flake-utils.lib.eachDefaultSystem
       (system:
         let
-          pkgs = import nixpkgs { inherit system; overlays = [ self.overlays.nodejs-20_x ]; };
+          pkgs = nixpkgs.legacyPackages.${system};
+          pkgsShell = import nixpkgs { inherit system; overlays = with self.overlays; [ nodejs-20_x bazel_7 ]; };
           pkgsBins = nixpkgs-stable.legacyPackages.${system};
-          pkgs' = import nixpkgs { inherit system; overlays = builtins.attrValues self.overlays; };
+          pkgsAll = import nixpkgs { inherit system; overlays = builtins.attrValues self.overlays; };
           pkgsX = xcompileTargets.${system} or null;
         in
         {
-          legacyPackages = pkgs';
+          legacyPackages = pkgsAll;
 
           packages = xcompilify { inherit pkgsX; pkgs = pkgsBins; }
             (p: {
@@ -35,12 +36,13 @@
             }) // {
             # doesnt need the same stability as those above
             nodejs-20_x = pkgs.callPackage ./dev/nix/nodejs.nix { };
+            inherit (pkgs.callPackage ./dev/nix/bazel.nix { inherit nixpkgs; }) bazel_7;
           };
 
-          # We use pkgs (not pkgs') intentionally to avoid doing extra work of
+          # We use pkgsShell (not pkgsAll) intentionally to avoid doing extra work of
           # building static comby/universal-ctags in our development
           # environments.
-          devShells.default = pkgs.callPackage ./shell.nix { };
+          devShells.default = pkgsShell.callPackage ./shell.nix { };
 
           formatter = pkgs.nixpkgs-fmt;
         }) // {
@@ -49,6 +51,7 @@
         comby = final: prev: { comby = self.packages.${prev.system}.comby; };
         nodejs-20_x = final: prev: { nodejs-20_x = self.packages.${prev.system}.nodejs-20_x; };
         p4-fusion = final: prev: { p4-fusion = self.packages.${prev.system}.p4-fusion; };
+        bazel_7 = final: prev: { bazel_7 = self.packages.${prev.system}.bazel_7; };
       };
     };
 }