Sanitize macOS rust-lld RPATH in generated toolchain

[dzbarsky]

Motivation

• Upstream macOS rust-lld binaries include an absolute LC_RPATH pointing at the Rust CI builder (/Users/runner/work/rust/rust/build/<triple>/llvm/lib), which leaks build provenance and creates a latent dylib-search risk.

Description

• Add a macOS-specific BUILD fragment (_MACOS_RUST_LLD_BUILD) that provides a genrule(name = "sanitize-rust-lld") which copies the upstream rust-lld and removes the leaked RPATH when present using @llvm//tools:llvm-otool and @llvm//tools:llvm-install-name-tool.
• Make include_linker conditional so non-macOS toolchains continue to use the upstream BUILD_for_compiler linker target while macOS toolchains append the sanitized rust-lld filegroup.
• Preserve the public rust-lld filegroup interface and its auxiliary linker data so consumers see the same targets while macOS gets the sanitized binary.

Testing

• Ran bazel query //rs/private:rustc_repository to validate repository rule visibility and this succeeded.
• Built a temporary package with the sanitized target via bazel build //.tmp_rust_lld_build_check:rust-lld and the build completed successfully.
• Formatted/checked the edited file with the repository buildifier invocation bazel run @buildifier_prebuilt//:buildifier -- /workspace/rules_rs/rs/private/rustc_repository.bzl and it ran successfully.
• Ran git diff --check to ensure there are no whitespace/errors and it succeeded.

---

Codex Task