Make `//go` usable in scripts run with `bazel run` (#3474)

Allows developers to build their own local convenience scripts around
`go`, e.g. to run `go mod tidy` backed by a hermetic Go toolchain.

This requires getting rid of the `env` attribute as it is not evaluated
if the binary is run as a dependency of another target.

Since `//go` selects a Go SDK suitable for the host, not the exec
platform, we forbid its use in the exec or host configuration. As remarked in
https://github.com/bazelbuild/rules_go/issues/2255, using raw `go` in
a genrule is not a good idea to start with.