[libshortfin] Clean up a few CI related items.

[stellaraccident]

• Disables ASAN ODR check properly (had syntax error in env var).
• Builds non-debug Python.
• Sets up LSAN suppressions to account for non-debug Python intentional leaks.
• Has CMake fetch the correct nanobind vs relying on pip (had another incident of mismatched version).
• Added options SHORTFIN_BUILD_STATIC=OFF, SHORTFIN_BUILD_DYNAMIC=ON, and SHORTFIN_LINK_DYNAMIC to control variants of libraries produced and linked to (disabling static in most configs saves a lot of build time).
• Run pytest with -s (stream output) option. For some reason, some of the subprocess tests are otherwise not working right on GHA runners. It looks like there may be some malformed I/O somewhere that gets less reliable with redirection. This isn't solved but does increase the chance of passing.