treewide: update sandboxroot to fedora 40, nix to 24.05

We didn't bump our sandboxroot in a long time, this updates it to fedora
 40
 and updates the nix shell to nixpkgs-24.05. It also bumps rules_oci to
 the current version.

Change-Id: I9ffb6f4dcd1a95be48b52015df987824dbb169f6
Reviewed-on: https://review.monogon.dev/c/monogon/+/3205
Tested-by: Jenkins CI
Reviewed-by: Leopold Schabel <leo@monogon.tech>
diff --git a/build/toolchain/musl-host-gcc/sysroot/tarball.bzl b/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
index c24c3f2..d7f18aa 100644
--- a/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
+++ b/build/toolchain/musl-host-gcc/sysroot/tarball.bzl
@@ -34,7 +34,7 @@
     linux_headers = ctx.file.linux_headers
     linux_headers_path = linux_headers.path
 
-    compiler_headers_path = "lib/gcc/x86_64-redhat-linux/12/include"
+    compiler_headers_path = "lib/gcc/x86_64-redhat-linux/14/include"
 
     musl_root = detect_root(ctx.attr.musl)
     musl_files = ctx.files.musl