[8.8.0] Add a remote repo contents cache

[fmeum]

Contains the following adaptions required for Bazel 8:

• DetailedIOException propagation had to be added to ensure that rewinding works correctly
• Since the path of the execroot depends on the name set in WORKSPACE (gone in Bazel 9), AbstractActionInputPrefetcher needed a combination of a lazy Supplier for the path as well as moving the temp directory to the output base, whose path is known at startup.

Original commit info follows:

Repositories are cached in a regular remote cache as AC entries for a synthetic command with the predeclared input hash as the salt. The contents are represented as an output file for the marker file and an output directory for the contents.

Upon a cache hit, the metadata of the files comprising the repository is downloaded and injected into an in-memory file system that is overlaid on the external directory on the native file system. Downloads of file contents only occur when Bazel needs to read a file (e.g., a BUILD or .bzl file) or if a file is an input to an action executed locally. This can save time taken to execute repo rules and compute file digests and disk space required to store the contents of external repositories.

The output of du -h $(bazel info output_base) after bazel build //src:bazel-dev and a fully up-to-date remote cache

• without the flag:

$ bazel info peak-heap-size used-heap-size-after-gc
peak-heap-size: 271MB
used-heap-size-after-gc: 123MB
$ du -h $(bazel info output_base) | tail -1
1.3G	/private/var/tmp/_bazel_fmeum/507738cfc7e6cde00e4a0230e9aa0722

• with the flag:

$ bazel info peak-heap-size used-heap-size-after-gc
peak-heap-size: 266MB
used-heap-size-after-gc: 120MB
$ du -h $(bazel info output_base) | tail -1
380M	/private/var/tmp/_bazel_fmeum/507738cfc7e6cde00e4a0230e9aa0722

Some repos are still materialized eagerly, which may not be necessary. Patched http_archive also can't be cached yet, so these numbers are likely to improve with further work on this feature.

Fixes #6359

RELNOTES[NEW]: The results of reproducible repository rules without dependencies added at runtime (e.g., via repository_ctx.watch or .getenv) can now be cached in a regular HTTP or gRPC remote cache if the new --experimental_remote_repo_contents_cache startup option is provided.

Closes #26860.

PiperOrigin-RevId: 827569755
Change-Id: I3a4e20c8c717c8503b5eb43545a8db162daef585
(cherry-picked from b8589c3, also includes 4f46e82)

[fmeum]

I realized that this lacks one more cherry-pick that simplifies it, will send it inline and mark as RFR when done.

[fmeum]

Ready again, I included 4f46e82

[fmeum]

@iancha1992