…etting_private_default_visibility (#452)

Required for Bazel 7 compatibility.

Note that rules_pkg 0.9.1 requires Python 3.6 or newer as the system's Python 3; this means we cannot build //distribution on Ubuntu 16.04 any more (which is fine, since it only affects the skylib developer workflow; users of skylib on Ubuntu 16.04 are not affected). Update CI config accordingly.

Fixes #414

While build settings allow for much cleaner flag and setting definitions
than `--define`, they have the major drawback that rules need to provide
dedicated support for them, which isn't the case for native and most
community-maintained rules.

This change attempts to bridge this gap by optionally exposing the value
of the common build setting types as Make variables to rules that depend
on them via the `toolchains` attribute: If the new `make_variable`
attribute is set, the value of the flag or setting is available as a
Make variable with that.

Consistency with pre-defined Make variables is enforced by limiting the
character set for `make_variable` values to `[A-Z0-9_]`. The new
attribute is also only added to int- and string-valued build settings as
the other types lack a canonical stringification.

Co-authored-by: Xùdōng Yáng <wyverald@gmail.com>

All actions which use tool or executable for which is not clear if it comes from a toolchain, must set a `toolchain` parameter ( migration of Automatic Exec Groups). 

As we discussed internally, I've modified actions so that it's recognised that tools are not from the toolchain. Hence, there will not be an error which states `Couldn't identify if tools are from implicit dependencies or a toolchain. Please set the toolchain parameter. If you're not using a toolchain, set it to 'None'.`. Hence, no need for the toolchain parameter.

Dev builds of Bazel are assumed to be more recent than any released
version.

This improves the error in the case your bzl_library does nothing.
Otherwise you end up with something weirder later:

```
BUILD:35:12: in deps attribute of bzl_library rule LABEL: 'DEP' does not produce any bzl_library deps files (expected .bzl)
```

Ideally we could set `allow_empty = False` on `srcs` but currently it's
valid to just have a bzl_library target that aggregates multiple other
libraries in its deps.

Co-authored-by: Ivo List <ilist@google.com>