Prevent unwanted path traversal in file writes from buildtools. (#1491)

* Prevent unwanted path traversal in file writes from buildtools.

Buildtools previously allowed file writes through arbitrary symlinks, which could result in unintended path traversal outside of the Bazel workspace.

Use safeopen.WriteFileBeneath to ensure file writes remain confined within the Bazel workspace root. Add the -disable_symlink_safety flag to both buildifier and buildozer to allow opting out of this restriction when modifying files targeted via external symlinks.

New Behavior:
- Without flag (default): both tools refused to write and exited with error (invalid cross-device link).
- With -disable_symlink_safety: both tools successfully formatted/edited the target file.

* Fixing MODULE.bazel

* Disabling Symlink safety for windows

* Only check symlink safety on Linux for now

* Also OS-gating buildozer test

---------

Co-authored-by: Tim Malmström <oreflow@google.com>