cc_toolchain make variables do not consider action_config tool paths

### Description of the bug:

When a `cc_toolchain` only has `action_config`s, and no `tool_path`s, the make variables (`$CC`, `$LD`, etc) are set to values which do not match the expected tool path, nor do they even necessarily point to things that exist.

It is not sufficient to expect a toolchain to specify both `action_config`s and `tool_path`s. `tool_path`s can not hermetically reference tools which do not reside under the same directory as the `cc_toolchain` which means you can create a toolchain that successfully compiles and links things, but cannot have `tool_path`s that match the paths to the tools in the `action_config`s.

This issue prevents my custom `cc_toolchain` from building [openssl](https://registry.bazel.build/modules/openssl) as it depends on `$CC` pointing to a real executable.

### Which category does this issue belong to?

C++ Rules

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Creating a `cc_toolchain` is not a simple thing, so I don't have a minimal, easily sharable example.

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 8.2.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

N/A

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text
N/A
```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

I don't believe this is a regression, it is just a little used part of `cc_toolchain` that probably doesn't get much exposure to real world testing.

### Have you found anything relevant by searching the web?

https://github.com/bazelbuild/bazel/issues/8438 - mentions that `tool_path`s are deprecated in favour of `action_config`s

### Any other information, logs, or outputs that you want to share?

Note: I marked this as a C++ Rule issue, but the functionality lies in the currently internal `cc_helper.bzl` file, not in the files that can be found in `rules_cc`.

I have a local branch of Bazel where I have made the make variables pull their paths from `action_config`s if they exist before falling back to `tool_path`s, and it successfully build openssl with my custom toolchain. I am making this issue as the first step to making a PR for this change.

Start in the internal cc_helper.bzl file, focusing on how make variables such as $CC and $LD are derived from cc_toolchain action_configs and tool_paths. Reproduce the behavior with a custom toolchain and the openssl module; done means the variables resolve to the executable paths used by the action_configs and openssl builds successfully.

Written by the indexing model from the issue text.