Rewritten URLs silently dropped if blocked

### Description of the bug:

The experimental downloader configuration (used by `--experimental_downloader_config`) supports the `rewrite` of URLs. If a rewritten URL isn't `allow`ed according to the rest of the configuration, the URL will get silently omitted. This behavior is surprising, and not entirely obvious - you could imagine the rewritten URL being an exception that's always allowed.

### Which category does this issue belong to?

External Dependency

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

```
rewrite example.com/(.*) example.org/$1

block *
```

and use `example.com/something` in an `http_archive` target

### Which operating system are you running Bazel on?

macOS

### What is the output of `bazel info release`?

release 6.4.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse master; git rev-parse HEAD` ?

_No response_

### Is this a regression? If yes, please try to identify the Bazel commit where the bug was introduced.

no

### Have you found anything relevant by searching the web?

no

### Any other information, logs, or outputs that you want to share?

_No response_

Start by reproducing the behavior with --experimental_downloader_config, the rewrite/block rules shown, and an http_archive target. Trace how rewritten URLs are handled against the allow/block configuration, then add regression coverage; done means the behavior is explicit and no longer silently omits the rewritten URL.

Written by the indexing model from the issue text.