Use --sysroot when compiling against the NDK

Match the NDK build by using --sysroot to point to the NDK headers
rather than manually specifying the include directories with -isystem.
Also remove --nostdlibinc from the global cflags so it is not used
for NDK builds, and manually add it back for non-NDK builds.

This relands I42ed714ba534d8ce252609bf618d4e3433875f28 with a fix to
also apply -nostdlibinc to rust bindgen compilations.

Bug: 374130155
Test: all NDK modules build
Test: TestIncludeDirectoryOrdering
Flag: EXEMPT refactor
Change-Id: Ib809ca2790b6a62f52e5492a67767b49c25fd702