js_binary ability to access resolved toolchains

I have a 3rd party node module which attempts to spawn `curl` under the hood. However, using `--incompatible_strict_action_env` removes the system's `PATH` and therefore `curl` is not found.

What is the best way to make `curl` (or any other executable) available to the build actions that needs it? My current thoughts:

1. Set a specific `PATH` environment variable of the `js_binary` rule in question. (This seems wrong though because it's OS-specific and may not work well with RBE)
2. Build `curl` within the repo itself. (Seems like a lot to try to get this to work, but may be a good option?)
3. Create a toolchain that downloads `curl` for the OS and pass it into the `js_binary` rule (somehow) 

Any thoughts? And if going with # 3, is the best thing to do create a wrapper rule around `js_binary_lib.create_launcher()`, or could `js_binary` itself accept an attribute that uses the toolchain?

Start by reviewing the js_binary behavior under --incompatible_strict_action_env and the launcher entry point js_binary_lib.create_launcher(). Compare the proposed PATH, repository-built curl, and toolchain approaches, including how a toolchain could be passed to js_binary. Done means documenting or implementing a clear supported way for actions to access resolved executables.

Written by the indexing model from the issue text.