fix: make python_headers targets compatible with layering checks (#3420)

Previously the headers from this target were available because it
depends on python_headers_abi3, but that fails downstream
layering_checks since the headers weren't direct. Now it re-exports the
same headers as that underlying target to satisfy those checks.

Inspectable with:

```
bazel cquery --output=starlark --starlark:expr 'providers(target)["@@rules_cc+//cc/private:cc_info.bzl%CcInfo"].compilation_context.direct_public_headers' @rules_python//python/cc:current_py_cc_headers
```

---------

Co-authored-by: Richard Levasseur <rlevasseur@google.com>
Co-authored-by: Richard Levasseur <richardlev@gmail.com>
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17aa502..4f1911f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,6 +78,8 @@
   ([#3085](https://github.com/bazel-contrib/rules_python/issues/3085)).
 * (toolchains) local toolchains now tell the `sys.abiflags` value of the
   underlying runtime.
+* (toolchains) The `python_headers` target is now compatible with
+  layering_check.
 * (performance) 90% reduction in py_binary/py_test analysis phase cost.
   ([#3381](https://github.com/bazel-contrib/rules_python/pull/3381)).
 * (gazelle) Fix `gazelle_python_manifest.test` so that it accesses manifest files via `runfile` path handling rather than directly ([#3397](https://github.com/bazel-contrib/rules_python/issues/3397)).
diff --git a/python/private/hermetic_runtime_repo_setup.bzl b/python/private/hermetic_runtime_repo_setup.bzl
index 4bcc1c1..c3c2755 100644
--- a/python/private/hermetic_runtime_repo_setup.bzl
+++ b/python/private/hermetic_runtime_repo_setup.bzl
@@ -126,6 +126,7 @@
     )
     cc_library(
         name = "python_headers",
+        hdrs = [":includes"],
         deps = [":python_headers_abi3"] + select({
             "@bazel_tools//src/conditions:windows": [":interface"],
             "//conditions:default": [],