Isolation leaking/escaping with go_test.data

### What version of rules_go are you using?

0.50.1

### What version of gazelle are you using?

0.39.0

### What version of Bazel are you using?

7.4.0

### Does this issue reproduce with the latest releases of all the above?

Yes

### What operating system and processor architecture are you using?

linux/amd64

### Any other potentially useful information about your toolchain?

### What did you do?

We are testing rbe for the first time, and noticed that some of the tests that worked before no longer work and require some fix, because of the more strict isolation from rbe workers. I think local runs without rbe should probably apply the same isolation and also fail them to be consistent.

The first case is we have a `go_test` defined like this:

```bzl
go_test(
name = "foo_test",
size = "small",
srcs = [
...,
],
data = glob(["testdata/**"]), # one of the tests opened `testdata/foo.yaml`
embed = [":foo"],
deps = [
...,
],
)
```

And for remote worker to work we need to add an explicit filegroup rule over the inlined `glob`:

```bzl
go_test(
name = "foo_test",
size = "small",
srcs = [
...,
],
data = [":testdata"],
embed = [":foo"],
deps = [
...,
],
)

filegroup(
name = "testdata",
srcs = glob(["testdata/**"]),
visibility = ["//visibility:public"],
)
```

To be honest I don't fully understand the difference between inlined `glob` and an explicit filegroup rule 😅

The second case is that a test file opened a file from a different directory (e.g. `os.Open("../foo/testdata/foo.yaml"`), without declaring it in `go_test.data`. That somehow worked locally, and only failed when rbe is involved.

### What did you expect to see?

For the second case I definitely expect it to fail locally unless an explicit `go_test.data` is declared. For the first case, I don't understand the difference between them, but apparently there is a difference so I would expect it to have consistent behavior local vs. remote.

### What did you see instead?

Start by reproducing the two cases with the shown go_test data declarations under local execution and remote execution. Inspect the rules_go handling of go_test data and test isolation; done means undeclared files fail locally and inline glob data behaves consistently with an explicit filegroup.

Written by the indexing model from the issue text.