Fix bootstrapping in Docker images.

Turns out, we couldn't run jarjar because the Java launcher script looks for the .jars in the runfiles and build-runfiles is stubbed out during bootstrapping.

The only reason why this worked at all is that sandboxing *also* doesn't work during bootstrapping but it causes the creation of symlinks that happened to be just in the right place for the Java launcher to find the .jars .

The fix is:

  - Explicitly disable sandboxing during bootstrapping so that coincidences like this don't happen again
  - Pass a --javabase and --host_javabase option during the bootstrap build so that we don't need any symlinks to access to JVM
  - Invoke jarjar using its deploy jar instead of the launcher script.

That was fun.

--
PiperOrigin-RevId: 145083357
MOS_MIGRATED_REVID=145083357
diff --git a/scripts/bootstrap/bootstrap.sh b/scripts/bootstrap/bootstrap.sh
index 697410b..ee754f7 100755
--- a/scripts/bootstrap/bootstrap.sh
+++ b/scripts/bootstrap/bootstrap.sh
@@ -33,6 +33,9 @@
 if [ "${JAVA_VERSION}" = "1.7" ]; then
   : ${BAZEL_ARGS:=--java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain_jdk7 \
         --host_java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain_jdk7 \
+        --javabase=$JAVA_HOME \
+        --host_javabase=$JAVA_HOME \
+        --spawn_strategy=standalone \
         --nojava_header_compilation \
         --define JAVA_VERSION=1.7 --ignore_unsupported_sandboxing \
         --compilation_mode=opt \
@@ -40,6 +43,9 @@
 else
   : ${BAZEL_ARGS:=--java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain \
         --host_java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain \
+        --javabase=$JAVA_HOME \
+        --host_javabase=$JAVA_HOME \
+        --spawn_strategy=standalone \
         --nojava_header_compilation \
         --strategy=Javac=worker --worker_quit_after_build --ignore_unsupported_sandboxing \
         --compilation_mode=opt \