Honor build-script execution constraints in compilation and run actions (#4270)

`cargo_build_script(exec_compatible_with = ...)` currently constrains
the generated script target but not both actions that compile and run
it. A build script can therefore be scheduled on an execution platform
that the caller explicitly excluded.

Apply the constraint to the generated Rust binary and the build-script
run target. The analysis regression checks both stages and fails when
either propagation is removed.

Verification:
`//cargo/tests/cargo_build_script/compatible_with:exec_constraints_test`
and the owning build-script test suite pass on macOS. Buildifier and
`git diff --check` pass.