Provide/document a repo-wide way to make Bazel downloader trust system roots

### Description of the feature request:

## Problem Statement
When on a network with TLS inspection enabled, Bazel external repository downloads can fail with Java certificate validation errors even though the same URLs work in Chrome/curl because the corporate root CA is trusted by the system keychain, but not bazel.

Example failure:

```text
WARNING: Download from https://github.com/... failed:
class javax.net.ssl.SSLHandshakeException (certificate_unknown)
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
```

## What we tried
- `.bazelrc` with `common --action_env=BAZEL_USE_SYSTEM_CERTS=1`
- Does not help because `--action_env` affects build actions, not external repository downloads.
- `tools/bazel` wrapper exporting `BAZEL_USE_SYSTEM_CERTS=1`
- Did not fix cold external repository fetches in our testing.
- Passing system properties such as `--host_jvm_args=...`
- Only helps if we construct an explicit Java truststore and pass `javax.net.ssl.trustStore`.

## Request

Could Bazel provide or document a supported way to make the external repository downloader trust OS-managed certificate roots?

Ideally this would be configurable repo-wide, for example via a startup flag that can live in `.bazelrc`, rather than requiring every developer to export an environment variable before invoking Bazel.

Possible shape:

```text
startup --use_system_certs
```

### Which category does this issue belong to?

Configurability

### What underlying problem are you trying to solve with this feature?

_No response_

### Which operating system are you running Bazel on?

MacOS

### What is the output of `bazel info release`?

release 9.0.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with the external repository downloader and compare its behavior with the existing .bazelrc, tools/bazel wrapper, and --host_jvm_args approaches described in the issue. Determine whether a supported startup configuration can make cold downloads trust OS-managed roots, or document the existing supported path. Done means the repo-wide setup works for external downloads without per-developer environment exports.

Written by the indexing model from the issue text.