Add buildInfo metadata support

[jsharpe]

Implements Go 1.18+ runtime/debug.BuildInfo embedding in Bazel-built binaries with accurate dependency versions collected from Gazelle-generated package_info targets.

This change introduces a buildinfo aspect that traverses the dependency graph and collects version metadata via the package_metadata common attribute (set by go_repository's default_package_metadata in REPO.bazel files). The aspect follows the bazel-contrib/supply-chain gather_metadata pattern.

Features:

• Collects real module versions (e.g., v1.2.3) from package_info metadata
• Replaces (devel) sentinels with actual versions from package_info
• Supports both package_metadata (Bazel 5.4+) and applicable_licenses (legacy)
• Filters out internal monorepo packages to avoid invalid version strings
• Embeds build settings (GOOS, GOARCH, CGO_ENABLED, etc.) in BuildInfo
• Makes dependency information accessible via runtime/debug.ReadBuildInfo()

Implementation details:

• New buildinfo_aspect.bzl traverses all dependencies using attr_aspects=["*"]
• Version map file aggregates importpath→version tuples and passes to linker
• Link builder merges version map with buildinfo dependency list
• Follows supply-chain memory optimization pattern for depset handling
• Includes modinfo.go and buildinfo.go from Go stdlib for metadata generation

Limitations:

• Module checksums are not included as they are not available in package_metadata

This enables tools like go version -m and OpenTelemetry instrumentation to properly identify dependencies in Bazel-built binaries.

Fixes #3090 Fixes #4159

🤖 Generated with Claude Code

[fmeum]

@jsharpe Could you edit the commit messages to remove the fmeum mention? Otherwise I get an email on every push 😅