Check private cc_common.link arguments once

Copybara Import from https://github.com/bazelbuild/rules_cc/pull/822

BEGIN_PUBLIC
Check private cc_common.link arguments once (#822)

Combine the archive-output predicate with the existing cc_common.link private-argument predicates so callers receive one check_private_api invocation. Preserve existing allowlist behavior, argument normalization, and caller-stack depth.

Validation: 51 remote C++ common and link-build-variable tests passed.

Closes #822
END_PUBLIC

Tested:
    TAP train for global presubmit queue
    []
COPYBARA_INTEGRATE_REVIEW=https://github.com/bazelbuild/rules_cc/pull/822 from dzbarsky:codex/starlarkify-link-private-api-checks 87ec078b62b14ac1a26564625898221479035080
PiperOrigin-RevId: 958324374
Change-Id: I00eff33a6c72c382cf8d149bc7337ce72bf5823e

cc/private/cc_common.bzl

diff --git a/cc/private/cc_common.bzl b/cc/private/cc_common.bzl
index d78312c..f5cfd7d 100644
--- a/cc/private/cc_common.bzl
+++ b/cc/private/cc_common.bzl
@@ -89,10 +89,8 @@
         use_shareable_artifact_factory = _UNBOUND,
         build_config = _UNBOUND,
         emit_interface_shared_library = _UNBOUND):
-    if output_type == "archive":
-        _cc_internal.check_private_api(allowlist = _PRIVATE_STARLARKIFICATION_ALLOWLIST)
-
-    if use_test_only_flags != _UNBOUND or \
+    if output_type == "archive" or \
+       use_test_only_flags != _UNBOUND or \
        never_link != _UNBOUND or \
        test_only_target != _UNBOUND or \
        native_deps != _UNBOUND or \