Identify actions with invalid exec groups/toolchains

It is unfortunately possible to create actions that declare an exec group (or toolchain, for automatic exec groups) that don't match the actual tools used in the action.

I've [written up a document](https://docs.google.com/document/d/18wDqEVqQRgzVlUIQMv7uP9MnyRMdOL6BR-N1970aToQ/edit?usp=sharing) explaining the problem in some detail, and am working on detection in Bazel to deal with it.