Add support for silencing nano zone warnings that arise from asan+macOS

[jonmeow]

Note this will need to be set per-cc_binary, but I don't think there's a good way to avoid that.

I didn't try hijacking the cc_binary rule name because that felt a bit excessive. We probably will have a few binaries we want to run directly, but I don't think it needs to be addressed on every last one.

This is part of addressing #1404