[8.8.0] Fix and consolidate repo env handling (partial)

[fmeum]

Manual port of only the essential API changes from 01407ce needed by later feature commits, since the full CommandEnvironment repo-env consolidation does not apply to 8.x:

• Add EnvironmentVariableValue record type
• Add RepoEnvironmentFunction with --repo_env + client env fallback
• Register REPOSITORY_ENVIRONMENT_VARIABLE in SkyFunctions and SkyframeExecutor
• Update EnvVar.getSkyKey() to use RepoEnvironmentFunction
• Update EnvVar.isOutdated() to use EnvironmentVariableValue

On 8.7.0, RepoEnvironmentFunction checks --repo_env first, then falls back to the client environment via ClientEnvironmentFunction, since the consolidated repo env computation from CommandEnvironment is not present.

Additionally includes the regression test from #29946 (test_unrelated_env_var_does_not_invalidate_repo): changing an unrelated environment variable via an interleaved bazel mod command must not refetch a repository that doesn't depend on it. #29946's production fix is not needed here because this narrow port injects only repoEnvFromOptions into REPO_ENV and falls back to the already per-variable ClientEnvironmentFunction for everything else, so an unrelated client variable never mutates the whole-map node.

Original commit message follows:

The current invalidation logic didn't take --incompatible_repo_env_ignores_action_env and --experimental_strict_repo_env into account, which resulted in incorrect invalidation of repo rules and module extensions.

This is addressed by a larger refactoring that consolidates the logic that computes the effective environment for repository rules and module extensions in CommandEnvironment. This environment is then read and sliced by a new RepoEnvironmentFunction that operates analogously to ClientEnvironmentFunction.

Along the way, the variety of terminology in CommandEnvironment and various SkyFunctions is cleaned up to consistently use:

• repoEnv to refer to the environment seen by repo rules and module extensions, which may or may not see the full client env based on the value of --experimental_strict_repo_env and
• nonstrictRepoEnv, which refers to same environment with, conceptually, --experimental_strict_repo_env forced to false. This is used for certain non-hermetic operations such as downloader and credential helper logic.

Closes #28168.

PiperOrigin-RevId: 854228202
Change-Id: I900f260dd5d0c6e20dcc32eaee0821567e60d5d1
(cherry picked from commit 01407ce)

[github-actions]

Thank you for contributing to the Bazel repository! This pull request has been marked as stale since it has not had any activity in the last 30 days. It will be closed in the next 30 days unless any other activity occurs. If you think this PR is still relevant and should stay open, please post any comment here and the PR will no longer be marked as stale.