[bazel] make rust_rules deps cacheable

[timothytrippel]

The rust_rules attempt to download the rust_linux_x86_64 external repository using the ctx.download action. Unfortunately, it seems this action does not first check in the repository cache for files before downloading, where as the ctx.download_and_extract action does. This is vaguely hinted at in the bazel repository rules documentation. Specifically, the description for the sha256 parameter of the download action only states: "the expected SHA-256 hash of the file downloaded. This must match the SHA-256 hash of the file downloaded ..."; while the the description for the sha256 parameter of the download_and_extract action additionally states: "... If provided, the repository cache will first be checked for a file with the given hash; a download will only be attempted if the file was not found in the cache. After a successful download, the file will be added to the cache."

Moreover, after testing out a patch of the rules_rust repository that replaces the ctx.download action with the ctx.download_and_extract action the rust_linux_x86_64 repository files are then found in the pre-populated repository cache (prepared with the prep-bazel-airgapped-builds.sh script), instead of downloaded from the network.

To fix this issue and support airgapped SW builds, the following item must be addressed:

• fork and patch the rules_rust repo (see this commit)

Addressed in: #12526

• use the forked / patched rules_rust repo in the opentitan bazel workspace
• update the prep-bazel-airgapped-builds.sh to prefetch and cache the rust_linux_x86_64 external repository

[timothytrippel]

CC: @cfrantz