Give root modules ultimate control over registered toolchains

### Description of the feature request:

I was asked to file this by @meteorcloudy / @fmeum / @Wyverald. Additional context is on the [bazel slack](https://bazelbuild.slack.com/archives/C014RARENH0/p1751579107076289).

The gist of the request is: currently, any `bazel_dep` can call `register_toolchains` on anything they want, and the root module cannot control or prevent this in any way short of patching the upstream project(s) to remove the offending registration.

Some modules ([rules_rust](https://github.com/bazelbuild/rules_rust/issues/2818) being an example) have chosen to build a mechanism for this into their extensions, but this really seems like something that should be handled at the platform level.

### Which category does this issue belong to?

External Dependency

### What underlying problem are you trying to solve with this feature?

An example of where this became a bug in our case (this is also in the slack thread) is: We needed to use a very specific protobuf version and runtime, so we registered our own, and then a bug related to a bzlmod migration resulted in two different copies of the toolchain type being used (this is the "duplication of singletons" problem highlighted in issues like [this one from rfcc](https://github.com/bazel-contrib/rules_foreign_cc/pull/1374)). This resulted in [the incorrect upstream toolchain](https://github.com/protocolbuffers/protobuf/blob/847e7d85c45527ff504eaaef3e4320312a559d2a/MODULE.bazel#L119) being silently used instead of ours. (If the upstream toolchain was not registered, we would have gotten an obvious error message rather than silently using the wrong one).

In practice, working around this issue today (unloading the footgun) means we need to apply `single_version_overrides` to _every single module in our transitive graph_ to patch out all `register_toolchains` calls.

### Which operating system are you running Bazel on?

linux

### What is the output of `bazel info release`?

release 8.2.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with the register_toolchains behavior described in the issue and the referenced MODULE.bazel example; the issue does not name a Bazel source file or test. Done should let a root module control or prevent transitive toolchain registrations without patching every dependency, while avoiding silent selection of the wrong toolchain.

Written by the indexing model from the issue text.