treewide: update sandboxroot to fedora 40, nix to 24.05

We didn't bump our sandboxroot in a long time, this updates it to fedora
 40
 and updates the nix shell to nixpkgs-24.05. It also bumps rules_oci to
 the current version.

Change-Id: I9ffb6f4dcd1a95be48b52015df987824dbb169f6
Reviewed-on: https://review.monogon.dev/c/monogon/+/3205
Tested-by: Jenkins CI
Reviewed-by: Leopold Schabel <leo@monogon.tech>
diff --git a/build/toolchain/llvm-efi/cc_toolchain_config.bzl b/build/toolchain/llvm-efi/cc_toolchain_config.bzl
index f9fd239..bedbd0f 100644
--- a/build/toolchain/llvm-efi/cc_toolchain_config.bzl
+++ b/build/toolchain/llvm-efi/cc_toolchain_config.bzl
@@ -198,7 +198,7 @@
         features = [default_link_flags_feature, default_compile_flags_feature, hybrid_gnu_msvc_feature, lto_feature],
         # Needed for various compiler built-in headers and auxiliary data. No system libraries are being used.
         cxx_builtin_include_directories = [
-            "/usr/lib64/clang",
+            "/usr/lib/clang/18/include/"
         ],
         toolchain_identifier = "k8-toolchain",
         host_system_name = "local",