b/ci: update build container to Fedora 35

Fedora 32 is EOL since over half a year, update to the current stable
Fedora release.

toolchains: adds clang as it's no longer part of the llvm package,
changes toolchain path references to GCC 11, and rebuilds the sysroot.

edk2: update to latest stable (old version cannot build with a newer
minor version of Python 3) and patch to disable -Werror and make the
newer included Brotli version work as it natively includes BUILD
files which need to be patched out to make the source files accessible.

linux: add patch to fix PVH ELF note entrypoint with binutils 2.32+ as
otherwise the .notes section gets emitted with broken alignment.

m/t/launch: RunMicroVM is broken if SerialPort is not set with newer
QEMU versions because fcntl(2) fails to interact with a broken file
descriptor. This is due to a confusion between nil interfaces and
interfaces containing a nil pointer causing Go to improperly pass the
file descriptor. Changing the type of SerialPort to the actual
interface resolves the issue.

Change-Id: I03a8cbf4f80a7363794dad1ff62ccb57e778cac3
Reviewed-on: https://review.monogon.dev/c/monogon/+/529
Reviewed-by: Leopold Schabel <leo@nexantic.com>
diff --git a/third_party/edk2/external/BUILD.repo b/third_party/edk2/external/BUILD.repo
index 7911678..9faa930 100644
--- a/third_party/edk2/external/BUILD.repo
+++ b/third_party/edk2/external/BUILD.repo
@@ -1,6 +1,12 @@
 genrule(
     name = "firmware",
-    srcs = glob(["**"]),
+    srcs = glob(
+        ["**"],
+        exclude = [
+            "CryptoPkg/Library/OpensslLib/openssl/boringssl/fuzz/*_corpus/**",
+            "CryptoPkg/Library/OpensslLib/openssl/fuzz/corpora/**",
+        ],
+    ),
     outs = [
         "OVMF_CODE.fd",
         "OVMF_VARS.fd",