Offer a hermetic_cc_import rule to ensure hermetic runtime libs

[cerisier]

Similar to what some folks have done with nixpkg.

Basically, patchelf the .so so that all the runtimes we offer replace those who were linked against system ones.