--experimental_split_coverage_postprocessing crashes in processwrapper sandbox

### Description of the bug:

--experimental_split_coverage_postprocessing crashes with processwrapper-sandbox (and possibly others, but not on remote execution for us).

```
ln: failed to create symbolic link '$HOME/.cache/bazel/_bazel_$USER/97af40d971490347704cc62951d0161c/execroot/_main/bazel-out/k8-dbg/testlogs/path/to/target/_coverage/gcov': Permission denied

error: $HOME/.cache/bazel/_bazel_$USER/97af40d971490347704cc62951d0161c/execroot/_main/bazel-out/k8-dbg/testlogs/path/to/target/_coverage/_cc_coverage.dat.data: Permission denied

external/bazel_tools/tools/test/collect_cc_coverage.sh: line 94: $HOME/.cache/bazel/_bazel_$USER/97af40d971490347704cc62951d0161c/execroot/_main/bazel-out/k8-dbg/testlogs/path/to/target/_coverage/_cc_coverage.dat: Permission denied

error: $HOME/.cache/bazel/_bazel_$USER/97af40d971490347704cc62951d0161c/execroot/_main/bazel-out/k8-dbg/testlogs/path/to/target/_coverage/_cc_coverage.dat.data: could not read profile data!No such file or directory

error: coverage collection script failed
```

The reason being that `--experimental_writable_outputs` is false by default. And that folder contains an input file.

My fix for now:

```patch
diff --git a/tools/test/collect_coverage.sh b/tools/test/collect_coverage.sh
index 49dad408d7..9992a892ca 100755
--- a/tools/test/collect_coverage.sh
+++ b/tools/test/collect_coverage.sh
@@ -83,6 +83,8 @@ if ! [[ $COVERAGE_DIR == $ROOT* ]]; then
fi

mkdir -p "$COVERAGE_DIR"
+# Ensure COVERAGE_DIR has write permissions for symlink creation
+chmod u+w "$COVERAGE_DIR"
COVERAGE_OUTPUT_FILE=${COVERAGE_OUTPUT_FILE:-"$COVERAGE_DIR/_coverage.dat"}
# make COVERAGE_OUTPUT_FILE an absolute path
if ! [[ $COVERAGE_OUTPUT_FILE == $ROOT* ]]; then
```

But it may be better to make folders writable by default ? Not quite sure what's the best fix.

### Which category does this issue belong to?

_No response_

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

setup --experimental_split_coverage_postprocessing, ensure that --noexperimental_writable_outputs applies, and run coverage.

### Which operating system are you running Bazel on?

Ubuntu

### What is the output of `bazel info release`?

9.0.1-

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

Nixpkgs based, heavily patched to fix bugs and add features.

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start with tools/test/collect_coverage.sh, especially the COVERAGE_DIR setup and the interaction with --experimental_split_coverage_postprocessing and --noexperimental_writable_outputs. Reproduce the coverage failure in a processwrapper sandbox, then verify that coverage collection can create its symlink and write its output without permission errors.

Written by the indexing model from the issue text.