External dependencies should have a `features = ["-please_disable_this_feature", ..."]` switch

### Description of the feature request:

Some external dependencies are already "bazelified", such as grpc, which is a blessing and a curse. The problem is that your toolchain is going to pass down all the flags for all your enabled features, including things like "-D_FORTIFY_SOURCE", and "-Werror", and then your dependency will fail to build.

When supplying your own BUILD file for a non-bazelified repo, you can switch things off:

```
package(features = ["-fortify", "-warnings"])
```

If I could do something like this:

```
http_archive(
name = "com_github_grpc_grpc",
urls = [
"https://github.com/grpc/grpc/archive/refs/tags/v1.39.1.tar.gz",
],
strip_prefix = "grpc-1.39.1",
sha256 = "024118069912358e60722a2b7e507e9c3b51eeaeee06e2dd9d95d9c16f6639ec",
features = ["-fortify", "-warnings"],
)
```

### What underlying problem are you trying to solve with this feature?

Obviously, with all the code in the world, in various states of shininess, it becomes important to be able to control which flags are used to build the code. And that shouldn't create a "lowest-common-denominator" burden for downstream code. In theory, I should be able to be as pedantic as I want, and still be able to build and link to code written by more pragmatically oriented development teams.

### Which operating system are you running Bazel on?

Ubuntu 20.04

### What is the output of `bazel info release`?

release 4.2.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse master; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

https://stackoverflow.com/questions/63588902/in-bazel-how-to-prevent-some-c-compiler-flags-from-passing-to-external-depend

### Any other information, logs, or outputs that you want to share?

_No response_

Start with the http_archive example and the existing package(features = [...]) behavior described in the issue. Trace how external dependencies receive toolchain feature flags, then define what supporting per-dependency feature switches would mean and verify that grpc can disable fortify and warnings without imposing a lowest-common-denominator configuration.

Written by the indexing model from the issue text.