`no-cache` tag does not apply to the persistent action cache

### Description of the bug:

According to https://docs.bazel.build/versions/main/be/common-definitions.html#common-attributes, adding the `no-cache` tag should "[result] in the action or test never being cached (remotely or locally)". This is false, at least using a toolchain that I have written.

I was able to work-around this issue by instead setting the `external` tag.

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

```
$ bazel query --output build 'kind("snyk_.* rule", //$SOME_PACKAGE/...)'
# $SOME_PATH/BUILD.bazel:5:16
snyk_scan_test(
name = "scan_vulnerabilities",
tags = ["no-cache", "requires-network"], # notice how it's tagged to NOT CACHE
generator_name = "$SOME_TARGET",
generator_function = "clojure_service",
generator_location = "$SOME_PATH/BUILD.bazel:5:16",
artifact = "//$SOME_PACKAGE:pom_xml",
policy = "//:.snyk_prod",
)
...
Loading: 0 packages loaded

$ bazel test //$SOME_PACKAGE:scan_vulnerabilities
...

$ bazel test //$SOME_PACKAGE:scan_vulnerabilities
INFO: Analyzed target //$SOME_PACKAGE:scan_vulnerabilities (0 packages loaded, 0 targets configured).
INFO: Found 1 test target...
Target //$SOME_PACKAGE:scan_vulnerabilities up-to-date:
bazel-bin/$SOME_PATH/scan_vulnerabilities
INFO: Elapsed time: 0.187s, Critical Path: 0.01s
INFO: 1 process: 1 internal.
INFO: Build completed successfully, 1 total action
//$SOME_PACKAGE:scan_vulnerabilities (cached) PASSED in 3.5s. # notice how it's served from cache

Executed 0 out of 1 test: 1 test passes.
INFO: Build completed successfully, 1 total action
```

### Which operating system are you running Bazel on?

macOS

### What is the output of `bazel info release`?

release 6.0.0-pre.20220216.3

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse master; git rev-parse HEAD` ?

```text
private repo
```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with the BUILD.bazel reproduction and run the two bazel test commands shown, comparing the second result with the documented no-cache behavior. Trace how the no-cache and external tags reach the persistent action cache; done means the no-cache target is not served from local or remote cache on the second run.

Written by the indexing model from the issue text.