Allow artifacts (or maybe `runfiles`?) to be marked non-symlinkable

### Description of the problem / feature request:

Node.js, a popular implementation of the MySpace theming language as a general-purpose programming environment, uses symlinks as part of its import resolution logic. This doesn't compose well with Bazel's use of symlinks in the execroot, especially the runfiles symlink forest.

It would be nice if certain parts of the runfiles tree could be marked "non-symlinkable", so that they always get written as regular files. I'm not sure whether this would be better at the `File` or `runfiles` level. I'm using library runfiles so the two are equivalent in my case.

### Feature requests: what underlying problem are you trying to solve with this feature?

Given a runfiles tree containing a crafted `node_modules/` directory, I'd like to have some files in there be symlinks (like today), and some be regular files. This would allow fine-grained control over the Node.js import resolver.

Start by comparing the File and runfiles levels mentioned in the request, focusing on how the runfiles symlink forest handles a crafted node_modules/ directory. Determine how a non-symlinkable marker would provide fine-grained control while preserving symlinks elsewhere, and consider the Node.js import-resolution behavior as the completion criterion.

Written by the indexing model from the issue text.