pw_build: Add pw_hermetic_cc_library Bazel rule

Adds `pw_hermetic_cc_library`, a custom Bazel rule for creating
incrementally-linked hermetic C/C++ static libraries.

An incrementally-linked hermetic library compiles sources from `srcs`,
takes private dependencies from `deps`, performs a relocatable link
(`ld -r`), and localizes all internal symbols using `objcopy`. Only
symbols explicitly listed in `global_symbols` (or `global_symbols_file`)
remain globally exported, avoiding symbol collisions across dependencies.

Features:
- Supports constraint checks for disallowed `.init_array` / `.fini_array`
  sections (`allow_init`, `allow_fini`).
- Supports undefined symbol verification against an allowlist
  (`undefined_symbols`) via a dedicated pyelftools script
  (`pw_build/py/pw_build/verify_hermetic_elf.py`).

Derived from:
https://cs.opensource.google/fuchsia/fuchsia/+/main:build/toolchain/hermetic_source_set.gni

TAG=agy
CONV=888be584-d2e8-42d1-9db3-ff5ef356cbf0

Bug: 529790473
Change-Id: I2bd0b9f895be01fa6322511b5fefe4e0a948a676
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/430932