mdbook: fix support for external repositories (#4027)

When any part of an `mdbook` target (either the `book.toml` or the
source files) comes from an external repository, the build was failing
because the rule's staging logic and its invocation logic handled
repository boundaries inconsistently.

This change:
- Updates `_map_inputs` in `mdbook.bzl` to map external repository paths
to `'external/'` instead of `'../'`.
- Hardens the process wrapper with a bounds check to ensure files are
not staged outside the shadow work directory.
- Adds an integration test to verify the fix and prevent regressions.

Made by Gemini, fixes #4026.