Add a --local-opam-switch flag to build-infer.sh that creates a
project-local opam switch (stored in _opam/ within the repo root)
instead of using or creating a global named switch.

This solves the problem of build-infer.sh modifying the shared global
opam switch (default: 5.3.0+flambda) when building. Running the script
without this flag will pin packages (charon, pyml, camlzip, etc.) and
install dependencies into the global switch, which can interfere with
other infer checkouts or OCaml projects on the same machine that share
that switch. A local switch keeps all installed packages isolated to
this specific project directory.

The new flag uses `opam switch create <path> --no-install` to create
the local switch. The --no-install flag is necessary because opam
auto-detects .opam files in the project root and would otherwise try
to resolve and install infer's dependencies (including charon) before
install_opam_deps() has had a chance to pin them, causing a "missing
dependency" error.

Interaction with other opam-related flags:
- --local-opam-switch and --user-opam-switch are mutually exclusive
  (the script errors out if both are passed). --user-opam-switch says
  "use whatever switch I already have active", while
  --local-opam-switch says "create a fresh isolated switch here".
- --only-setup-opam works as before: it sets up the (now local) switch
  and installs dependencies, then exits before building.
- --no-opam-lock is orthogonal and works unchanged: it controls
  whether opam resolves dependencies freely or uses the lockfile.
- If _opam/ already exists from a previous run, the switch is reused
  rather than recreated, supporting incremental builds.

Cleanup: `opam switch remove .` or `rm -rf _opam`.
The _opam directory is already in .gitignore.

CMake 4.x (shipped with Xcode 16.4 on macOS) removed compatibility
with cmake_minimum_required versions below 3.5, causing the
clang_compilation_db and cmake build system tests to fail.