fix(ci): ensure wheels are built with older manylinux

[lidavidm]

• Build binaries separately using an older glibc.
• Use a separate image with a new docker to run cibuildwheel.

Fixes #2350.

[WillAyd]

Looks good. Slightly tangential question - is there a reason we choose to do this all via docker instead of using the cibuildwheel service?

[lidavidm]

I chose docker mostly because then I can also run the exact same setup locally

[paleolimbot]

nanoarrow is admittedly much less complex, but we use cibuildwheel using mostly defaults, with https://github.com/apache/arrow-nanoarrow/blob/e54b7df525fa1d310a96687bd99902823402b26c/ci/scripts/test-python-wheels.sh#L44-L51 to test locally.