bazel: patch rules_oci to run tar with --no-xattrs

[Strum355]

Workaround for https://github.com/sourcegraph/devx-support/issues/622. This is portable between both bsdtar and gnutar. On gnutar, this is the default, so this changes nothing for CI builds. This only changes behaviour in macOS with bsdtar.

It is unclear to me where a final solution will exist:

• An issue was opened upstream in docker/moby, but the latest opinion is that this is an issue with rules_oci technically emitting docker-compatible formats that are incompatible with docker (Im not 100% sure yet that docker itself cant create a tarball that would fail to docker load, but I dont want to subject Christoph to more experiments lol) docker load fails with lsetxattr com.apple.provenance /manifest.json: operation not supported on Ventura & later moby/moby#47517
• A PR exists in rules_oci to use a hermetic BSD tar instead of system tar (doesnt work on nixos though coz dynamic libraries :sadge:). It uses mtree format to add files, I don't know yet if that works around xattr issue without also passing --no-xattr (my current belief is that it does not) refactor: use hermetic tar bazel-contrib/rules_oci#385

Test plan

Had Christoph run bazel run //cmd/batcheshelper:image_tarball, which succeeded with this patch