Enforce visibility on select() keys

[martis42]

Example:

my_rule(
  name = "buildme",
  deps = select({
    "//other/package:some_config": [":mydeps"]
  }))

Today, //other/package:some_config is exempt from visibility checking, even though it's technically a target dep of
buildme.

While this dep is "special" vs. other deps in various ways, there's no obvious reason why it needs to be special in this way. It adds an unclear corner case exception to visibility's API.

Implementation:

select() keys are not "normal" dependencies and don't generally follow the same code path. Hence them not being automatically visibility checked like others.

In particular, normal dependencies are found in ConfiguredTargetFunction and validity-checked in RuleContext.Builder. select() keys' only purpose is to figure out which other normal dependencies should exist. There's generally no need to pass them to RuleContext.Builder. Instead, Blaze passes their ConfigMatchingProviders, which remain useful for analysis phase attribute lookups.

RuleContext.Builder needs a ConfiguredTargetAndData to do validity-checking. This patch propagates that information for select() keys too.

We could alternatively refactor the validity checking logic. But that's an even more invasive change. Or do ad hoc validity checking directly in ConfiguredTargetFunction. But that's duplicating logic we really want to keep consolidated.

Backward compatibility:

This would break existing builds if config_setting defaulted to private visibility. So this change specially defaults config_setting to public visibility, with clarifying documentation. When ready we'll want to create an incompatible change to make config_setting the same as everything else.

Fixes #12669.

Closes #12877.

RELNOTES: config_setting now honors visibility attribute (and defaults to //visibility:public)
PiperOrigin-RevId: 354310777