feat: uv lock rule instead of genrule (#2657)

This change re-implements the `uv pip compile` as a set of rules instead
of
using a `genrule`. This makes the setup more RBE friendly and it also
fixes
some of existing issues in the exec tools toolchain.

The `lock` macro in the `//python/uv:lock.bzl` now creates three public
targets: `<name>`, `<name>.update` and `<name>.run`. The first will
provide you
with the locked `requirements.txt` file that is used in the
`<name>.update`
executable target when updating the in-source copy of the file. The
`<name>.run` provides an executable target that hardcodes all of the
`uv` args
from the `<name>` rule in a shell script and allows user to debug the
execution
and add extra arguments at the command line.

The `test` target is no longer included, but users can define it
themselves
with the help of `native_test`.

Things that I could not test and would benefit from the community help:
* Windows support - the repository has a rudimentary script, but I am
almost
  sure that it is likely not working, so PRs there are welcome.
* The integration tests are not running on RBE because of the current
RBE
  cluster setup. If you see issues in your RBE setup, PRs are welcome.
* `keyring` integration to pull packages from private index servers is
untested
  as of now, but I see no reason why it should not work.

Work towards #1325
Work towards #1975
Related #2663