refactor(toolchain): select bundled coverage wheels with select_whl (#4414)

refactor(toolchain): select bundled coverage wheels with select_whl

Before this change the coverage wheels bundled with the hermetic
toolchain
were stored as a nested dict keyed by the python ABI and the toolchain
platform, and the platform filtering was done in the Python update
script.

Now the update script stores all of the wheels as a flat list using a
format similar to `uv.lock` - `struct(url = ..., hash = "sha256:...")` -
and
the Starlark side uses `select_whl` to pick the wheel that is compatible
with
the python version and the toolchain platform. The update script no
longer
does any filtering, but it accepts multiple coverage versions, each with
an
optional PEP 508 marker for when it should be used, because newer
coverage
releases drop support for older python versions, e.g.:

```
bazel run //dev/update_deps:update_coverage_deps -- \
    "7.10.7; python_full_version < '3.15'" \
    "7.17.0; python_full_version >= '3.15'"
```

The marker is stored on each wheel and is evaluated against the python
version of the toolchain before selecting the wheel.

The wheel that is selected for each toolchain is unchanged, except for
the
python 3.15+ toolchains on the platforms without a platform specific
wheel,
which now fall back to the `py3-none-any` wheel of coverage 7.17.0
instead of
7.10.7.

This prepares for selecting the platform specific wheels for more of the
toolchain platforms.

Work towards #3902