Add support for fully hermetic sysroots

[AustinSchuh]

Clang wants, in order: C++ header files only when compiling for C++ -isystem external/llvm_toolchain_llvm/include/c++/v1/ -isystem external/llvm_toolchain_llvm/include/x86_64-unknown-linux-gnu/c++/v1/

C header files -isystem external/llvm_toolchain_llvm/lib/clang/16/include

We need a new flag_set which comes after the C++ headers to be able to inject them always, but after the C++ headers.

Support for this in toolchains_llvm can land after this gets merged and likely released, unfortunately.