Add an option to opt-out of PYTHONSAFEPATH

# 🚀 feature request

### Relevant Rules
`py_binary`

### Description
`py_binary` sets `PYTHONSAFEPATH=1` which while being a sensible default does cause problems. Most notably, in `rules_foreign_cc` where `py_binary` is used to wrap up the Meson build system (written in Python). While this is not an issue for the build system itself, it is an issue when Meson runs compilers or build scripts that are written in Python. The issue here is that Meson is starting processes which inherit Meson's environment variables including `PYTHONSAFEPATH`. This often breaks scripts which rely on importing modules from the directory in which they are contained.

### Describe the solution you'd like
I would like an option on `py_binary` that allows me to opt out of `PYTHONSAFEPATH`.
```starlark
py_binary(
name = "mypybinary",
safe_path = False, # defaults to True
)
```

### Describe alternatives you've considered
- Using `--action_env=PYTHONSAFEPATH=`: no effect
- Specifying the `env` argument on `py_binary` as follows: no effect

```starlark
py_binary(
name = "mypybinary",
env = {
"PYTHONSAFEPATH": ""
}
)
```

从 py_binary 规则开始，追踪 PYTHONSAFEPATH 的设置位置以及该规则的 env 参数是如何应用的。通过 rules_foreign_cc 的 Meson 用例重现继承问题，然后验证新选项在保留默认行为的同时，允许省略或禁用 PYTHONSAFEPATH。

由索引模型根据 Issue 内容生成。