Populate CXX during builds to avoid calling the system toolchain

[zanieb]

Closes #512

[zanieb]

Concretely, it seems like this means that libffi was previously built using g++ / Apple clang on macOS and now it'll use our LLVM toolchain as intended.

[zanieb]

We may just want to define target_cxx everywhere instead of falling back to host_cxx.

[geofft]

Good find!

Mildly unhinged idea - I wonder if we can use the Mac's Seatbelt sandboxing system to allowlist executables from the system to protect against things like this.