Add skip option to `multitools update`

When updating multitools with a scheduled job as documented in https://github.com/bazel-contrib/rules_multitool/blob/main/docs/automation.md, it could happen that there are some tools that should not be updated as they should stay pinned to a particular version or contain some breaking changes that need to be fixed first. In this case, it would be great if there is a way to skip a particular tool from not being updated, for instance via a `SKIP` environment variable as used in https://pre-commit.com/#temporarily-disabling-hooks.

Example usage could look like `SKIP=aws,ibazel multitool update` which would update everything but `aws` and `ibazel`.

Start with the multitool update command and the scheduled-job guidance in docs/automation.md. Trace how tool names are selected during an update and determine where the SKIP value would be handled. Done means `SKIP=aws,ibazel multitool update` leaves those tools unchanged while updating the others, with coverage for the behavior.

Written by the indexing model from the issue text.