fix(py_venv): Repair external repository imports

[arrdem]

Builds on #629 and fixes #610.

A brief summary of the bug is that previously the static venv machinery assumed that external imports were used only for site-packages/ style repositories coming from a pip implementation. This is in some cases false -- one of which is the use of local sub-repositories as sources of Python code.

Because of the false assumption that all external imports were being converted into copies, the existing implementation assumed that the repository name path segment could be dropped when inserting paths for non-relocated imports into the _aspect.pth file within a venv.

Unfortunately repairing this oversight in a portable and sound way is tricky. Simply using relative paths in .pth file can incur undesirable canonicalization and resolution of symlinks which produce broken runtime paths depending on the specifics of the sandboxing strategy. The Linux sandboxing implementation seems especially vulnerable to this.

Ultimately the only really sound way to achieve this would be to use a runfiles library, which has the further problem that the runfiles manifest structure operates at the level of individual files and not file trees so we'd have to make potentially unsound assumptions about scanning runfiles manifest entries for path prefixes and also take on a dependency on a "real" implementation of interacting with runfiles.

This PR explores a workaround where we use a customized .pth flow which allows us to be really careful about how entries are added to the path to avoid implicit symlink resolution operations that can produce .runfiles sandbox escapes.

Changes are visible to end-users: yes

• Searched for relevant documentation and updated as needed: yes
• Breaking change (forces users to change their own code or config): no
• Suggested release notes appear below: yes

Fixed a bug which caused imports from external modules to fail under the new py_[static_]venv_binary machinery.

Test plan

• New test cases added based on the repro report.

[CLAassistant]

All committers have signed the CLA.

[aspect-workflows]

Test

26 test targets passed

Targets

//examples/multi_version:py_version_default_test [k8-fastbuild]                           1s
//examples/multi_version:py_version_test [k8-fastbuild-ST-494921797612]                   1s
//examples/pytest:pytest_test [k8-fastbuild]                                              2s
//examples/pytest:sharded/test [k8-fastbuild]                                             3s
//examples/virtual_deps:pytest_test [k8-fastbuild]                                        1s
//py/private/py_venv:test_link [k8-fastbuild]                                             252ms
//py/tests/cc-deps:test_smoke [k8-fastbuild]                                              485ms
//py/tests/external-deps:test_can_import_runfiles_helper [k8-fastbuild]                   800ms
//py/tests/internal-deps:assert [k8-fastbuild]                                            445ms
//py/tests/py-binary:runfiles_from_pip_test [k8-fastbuild]                                953ms
//py/tests/py-external-venv:test [k8-fastbuild]                                           194ms
//py/tests/py-internal-venv:test [k8-fastbuild]                                           150ms
//py/tests/py-test:test_env_vars [k8-fastbuild]                                           658ms
//py/tests/py-venv-disable-systemsite:test [k8-fastbuild]                                 148ms
//py/tests/py-venv-disable-usersite:test [k8-fastbuild]                                   169ms
//py/tests/py-venv-enable-site:test [k8-fastbuild]                                        152ms
//py/tests/py-venv-standalone-interpreter:test [k8-fastbuild]                             171ms
//py/tests/py_image_layer:py_image_test [k8-fastbuild]                                    10s
//py/tests/py_venv_conflict:validate_import_roots [k8-fastbuild]                          225ms
//py/tests/py_venv_image_layer:my_app_amd64_layers_test [k8-fastbuild]                    56ms
//py/tests/py_venv_image_layer:my_app_arm64_layers_test [k8-fastbuild]                    72ms
//py/tests/py_venv_image_layer:py_amd64_image_command_test [k8-fastbuild]                 3s
//py/tests/py_venv_image_layer:py_amd64_image_content_test [k8-fastbuild]                 235ms
//py/tests/py_venv_image_layer:py_arm64_image_content_test [k8-fastbuild]                 5s
//py/tests/repo_relative_imports/test:test [k8-fastbuild]                                 491ms
//py/tests/rpy610:test [k8-fastbuild]                                                     150ms

Total test execution time was 32s. 20 tests (43.5%) were fully cached saving 1m 1s.

[github-actions]

e2e/use_release folder: LCOV of commit 7e899c1 during CI #1955

Summary coverage rate:
  lines......: 100.0% (2 of 2 lines)
  functions..: 100.0% (1 of 1 function)
  branches...: no data found

Files changed coverage rate: n/a