Brings re-entrant `git init`.

Brings:

* `git config`
* `git cat-file -e`
* `git fetch --negotation-tip`

Still need re-entrant `git init`.

Uses hermetic `bazel-git` downloads on supported platforms.

Falls back to `bazel-git` on `PATH`.

When we list the remote, we fully resolve the reference. Returning that resolved
reference removes ambiguity later in the logic.

If multiple references are listed, raise a failure.

This patch also adds:

- `git_dir`: create a `.git` declared directory from a filegroup
- `git_commit`: represent a `git` commit as a Bazel provider
- `git_checkout`: checkout a commit into a declared directory

These rules are stamped out in the `git_fetch` repository.

The network access is performed in the repository context to retrieve
the `.git` objects. The rest of the `git` operations are performed in
the action context. This has many benefits:

- On-demand I/O when actions are requested
- Separation of concerns for different `git` operations
- Remote cache and remote execution friendly actions

The actions use `rules_coreutils` to be hermetic.

_Currently_, the `git` CLI is used from the local machine to prove
out the operation and determine the needed functionality from the CLI.
A project is being brought up at bazel/git> to implement a hermetic
CLI implementation that provides _just enough_ to make this ruleset
hermetic.

Only build test targets and print relative paths where possible.