feat: add `git_fetch` repository rule

This patch also adds:

- `git_dir`: create a `.git` declared directory from a filegroup
- `git_commit`: represent a `git` commit as a Bazel provider
- `git_checkout`: checkout a commit into a declared directory

These rules are stamped out in the `git_fetch` repository.

The network access is performed in the repository context to retrieve
the `.git` objects. The rest of the `git` operations are performed in
the action context. This has many benefits:

- On-demand I/O when actions are requested
- Separation of concerns for different `git` operations
- Remote cache and remote execution friendly actions

The actions use `rules_coreutils` to be hermetic.

_Currently_, the `git` CLI is used from the local machine to prove
out the operation and determine the needed functionality from the CLI.
A project is being brought up at bazel/git> to implement a hermetic
CLI implementation that provides _just enough_ to make this ruleset
hermetic.