Add an option to opt-out of PYTHONSAFEPATH

# 🚀 feature request

### Relevant Rules
`py_binary`

### Description
`py_binary` sets `PYTHONSAFEPATH=1` which while being a sensible default does cause problems. Most notably, in `rules_foreign_cc` where `py_binary` is used to wrap up the Meson build system (written in Python). While this is not an issue for the build system itself, it is an issue when Meson runs compilers or build scripts that are written in Python. The issue here is that Meson is starting processes which inherit Meson's environment variables including `PYTHONSAFEPATH`. This often breaks scripts which rely on importing modules from the directory in which they are contained.

### Describe the solution you'd like
I would like an option on `py_binary` that allows me to opt out of `PYTHONSAFEPATH`.
```starlark
py_binary(
name = "mypybinary",
safe_path = False, # defaults to True
)
```

### Describe alternatives you've considered
- Using `--action_env=PYTHONSAFEPATH=`: no effect
- Specifying the `env` argument on `py_binary` as follows: no effect

```starlark
py_binary(
name = "mypybinary",
env = {
"PYTHONSAFEPATH": ""
}
)
```

Start at the py_binary rule and trace where PYTHONSAFEPATH is set and how the rule's env argument is applied. Reproduce the inheritance problem through the rules_foreign_cc Meson use case, then verify that the new option preserves the default while allowing PYTHONSAFEPATH to be omitted or disabled.

Written by the indexing model from the issue text.