Motivation for this change

Newer versions of Bazel are moving away from built-in rules_cc and instead allow fetching it as an external dependency in a WORKSPACE file. If removed in the fixed-output fetch phase, building will fail to download it. This can be seen e.g. in #73097.

The new rules_cc live here, which say:

The rules are being incrementally converted from their native implementations in the Bazel source tree.

This PR changes things to allow disabling removing rules_cc with a flag to buildBazelPackage, set to true by default to replicate the behavior today. Additionally, this only affects the deps derivations, which are fixed-output, and thus shouldn't affect any packages today.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @abbradar @Profpatsch