Add target_toolchain_roots and make sysroot more hermetic

[AustinSchuh]

It is useful when cross compiling to have 1 LLVM build used as the compiler, and multiple others used for their libc++/target libraries.

This concept forces us to be much more robust about what comes from the target toolchain, and what comes from the compiler. Leave toolchain_roots for the compiler roots, but add a new flag, target_toolchain_roots with the same semantics for target toolchains. This necesitates being much more clear internally about what comes from what.

This isn't fully enough to make everything hermetic, clang still has some autodetection logic left over when using sysroots. We want to very explicity specify the resource directory it should use, as well as where the standard C/C++ libraries come from so it finds only what we want it to find.

When pulling from a sysroot, we need to know the version of stdc++ to find includes. Use the stdlib variable for that by supporting "stdc++-12" for example, and parsing the number out.

[AustinSchuh]

bazelbuild/rules_cc#304 needs to land and be available before this can merge. But I would appreciate feedback on this before then as that could take a bit.

We used features before for asan/msan/cuda/etc, but I think we can use flags + select instead and avoid needing to change rules_cc again. Feedback welcome on the best way to do all that.