Using --experimental_remote_download_outputs appears to be broken

https://blog.bazel.build/2019/05/07/builds-without-bytes.html#how-to-use-it
Building GRPC against openssl with --experimental_remote_download_outputs=minimal set results in a compiler error in which the .h openssl libraries are not found.

https://chromium.googlesource.com/external/github.com/grpc/grpc/+/refs/heads/master/BUILD#6398
Setting @openssl//:ssl in this target to the rules_foreign_cc build output of rules foreign, then:
.bazelrc:
build:download-minimal --nobuild_runfile_links
build:download-minimal --experimental_inmemory_jdeps_files
build:download-minimal --experimental_inmemory_dotd_files
build:download-minimal --experimental_remote_download_outputs=minimal

bazel build --config=local --config=download-minimal @grpc//:tsi

```Compiling src/core/tsi/ssl_transport_security.cc failed: (Exit 1): clang failed: error executing command external/sysroot_toolchain/wrappers/clang -MD -MF bazel-out/k8-fastbuild/bin/external/grpc/_objs/tsi/ssl_transport_security.pic.d ... (remaining 87 argument(s) skipped)
external/grpc/src/core/tsi/ssl_transport_security.cc:659:24: error: use of undeclared identifier 'X509_V_FLAG_PARTIAL_CHAIN'
X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_TRUSTED_FIRST);
^
external/grpc/src/core/tsi/ssl_transport_security.cc:659:52: error: use of undeclared identifier 'X509_V_FLAG_TRUSTED_FIRST'
X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_TRUSTED_FIRST);
^
external/grpc/src/core/tsi/ssl_transport_security.cc:1035:3: error: use of undeclared identifier 'SSL_get0_alpn_selected'
SSL_get0_alpn_selected(impl->ssl, &alpn_selected, &alpn_selected_len);
^
external/grpc/src/core/tsi/ssl_transport_security.cc:1721:11: error: use of undeclared identifier 'SSL_CTX_set_alpn_protos'
if (SSL_CTX_set_alpn_protos(
^
external/grpc/src/core/tsi/ssl_transport_security.cc:1906:7: error: use of undeclared identifier 'SSL_CTX_set_alpn_select_cb'
SSL_CTX_set_alpn_select_cb(impl->ssl_contexts[i],
^
```

With download-minimal set, it appears the .h files generated from rules_foreign_cc do not get propagated properly to the input set of rules depending on it.

Start with the gRPC dependency declaration at the referenced BUILD line and the .bazelrc download-minimal settings, then reproduce with `bazel build --config=local --config=download-minimal @grpc//:tsi`. Investigate how rules_foreign_cc build outputs and generated headers enter the input set of dependent targets. Done means the same build finds the OpenSSL headers and compiles successfully with minimal remote downloads.

Written by the indexing model from the issue text.