Normalize Clang forwarded system header paths

[cerisier]

Port of bazelbuild#4321 onto this fork's main, preserving its existing path mapper and user compile-flag regressions. This is the copy needed by consumers such as rules_rs that pin hermeticbuild/rules_rust.

Cargo build scripts change working directory, so execroot-relative header operands must be made absolute. Recognize -internal-externc-isystem and preserve -Xpreprocessor while awaiting the header path, just as for -Xclang. Otherwise Clang loses libc headers, producing errors such as stdlib.h not found. Absolute paths and unrelated flags stay unchanged.

Eight generated-action regressions cover both forwarding forms, both header categories, and relative/absolute operands. The corresponding tests expose three missing rewrites on upstream's unmodified baseline. All 40 tests in this fork's flag-handling package pass:

USE_BAZEL_VERSION=8.6.0 bazel test --config=remote --lockfile_mode=off \
  --local_test_jobs=1 //cargo/tests/cargo_build_script/cc_args_and_env:all

The first concurrent macOS run hit a generate-xml.sh segmentation fault on the existing bindir_relative_test; the sequential retry passed all 40 tests. Buildifier formatting/lint and whitespace checks pass.

Merge blocker for hermeticbuild/hermetic-llvm#819 and hermeticbuild/hermetic-llvm#820, alongside the bazelbuild PR. Consumers must adopt a release or pin containing this fix before the hermetic-llvm stack merges.