Double down on all hermetic tooling should be provided in `tools`.

`rules_coreutils` should be the ruleset that provides hermetic coreutils,
not `rules_download`.

Users should only pay for what they use and if they never use core utilities,
we download it everytime.

Allows running commands using hermetically provided binaries:

```py
archive = use_repo_rule("@rules_download//download:defs.bzl", "download_archive")

archive(
    ...,
    commands = {
        "symlink": ["ln", "-s", "abc", "foo"],
    },
)
```

`use_repo_rule` is available in `6.4.0` and above.

It _hugely_ simplifies what we want to do.

That should be the new minimum version for our rulesets.

As of writing, `6.4.0` is not released. The release candidates do not have
the `use_repo_rule` added, yet. Most rules use `last_rc` Bazel version.

`visibility` is available in 6.0+.