bazel-bootstrap fails to build: chokes on -Wl,--package-metadata in LDFLAGS

### Description of the bug:

bazel-bootstrap 4.2.3+ds-11.1build1 fails to build from source on Ubuntu resolute:

```
Traceback (most recent call last):
File "/tmp/bazel_xLYnPoI6/out/external/local_config_cc/cc_toolchain_config.bzl", line 1229, column 53, in _impl
return cc_common.create_cc_toolchain_config_info(
Error in create_cc_toolchain_config_info: Invalid toolchain configuration: expected '{' at position 24 while parsing a flag containing '-Wl,--package-metadata=%7B%22type%22'
```

It looks like that the build chokes on the colon in the `-Wl,--package-metadata=` flag.

### Which category does this issue belong to?

Core

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Add `-Wl,--package-metadata=%7B%22type%22:%22deb%22%7D` to `LDFLAGS`.

### Which operating system are you running Bazel on?

Ubuntu resolute

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

Corresponding bug in Ubuntu: https://bugs.launchpad.net/ubuntu/+source/bazel-bootstrap/+bug/2141591

Start by reproducing the bazel-bootstrap build on Ubuntu resolute with LDFLAGS set to -Wl,--package-metadata=%7B%22type%22:%22deb%22%7D. Inspect the generated external/local_config_cc/cc_toolchain_config.bzl at the reported create_cc_toolchain_config_info failure and trace how the linker flag is parsed. Done means bazel-bootstrap builds from source with that flag present.

Written by the indexing model from the issue text.