Separate oci_load and oci_tarball rules

With the current rules_oci ruleset oci_load produces both the script to load an image as a tarball as well as the actual tarball in an extra output group. This however poses a problem when the build graph itself depends on the tar as this means that the OCI layout tree artifact becomes a runfile and is carried with it, which is incorrect and a lot of runfile packagers cannot deal with tree artifact runfiles. These runfiles are also not needed for the tar output, only for the load script. So these should really be separate rules.

Start by tracing the current rules_oci implementation of oci_load and how its output groups and runfiles are assembled. Separate the tar output from the load script so the tar does not carry the OCI layout tree artifact, while the load script retains the runfiles it needs; verify both outputs through the repository's existing tests.

Written by the indexing model from the issue text.