Support other output modes than 0555

### Description of the problem / feature request:

When building tarballs with [`pkg_tar`][1], the *output* tarball has a 0555 mode. But tarballs are generally not going to be executable. I think the default mode should be 0666 or, if you want to be very conservative 0444. In both those cases, it would be nice to respect the user's umask, as long as it did not interfere with reproducible builds. An alternative would be to provide an explicit `pkg_tar` parameter that functions similarly to the existing `mode` (although `mode` is for files packaged inside the tarball, not for the tarball itself, #2925).

### Feature requests: what underlying problem are you trying to solve with this feature?

Claiming that output tarballs are executable makes it harder to auto-complete sibling paths that are executable. And if you attempt to execute the tarball, I think an EPERM is more obvious than "cannot execute binary file".

### Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

```console
$ bazel version
Build label: 0.15.0- (@non-git)
Build target: bazel-out/k8-opt/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar
Build time: Wed Jun 27 14:43:20 2018 (1530110600)
Build timestamp: 1530110600
Build timestamp as int: 1530110600
$ cat WORKSPACE
workspace(name = "test")
$ cat BUILD.bazel
load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")

pkg_tar(
name = "test",
srcs = glob(
["*.txt"],
exclude_directories = 1,
),
mode = "0666",
)
$ touch text.txt
$ bazel build test
Starting local Bazel server and connecting to it...
........
INFO: Analysed target //:test (16 packages loaded).
INFO: Found 1 target...
Target //:test up-to-date:
bazel-bin/test.tar
INFO: Elapsed time: 1.360s, Critical Path: 0.11s
INFO: 1 process: 1 processwrapper-sandbox.
INFO: Build completed successfully, 6 total actions
$ ls -l bazel-bin/test.tar
-r-xr-xr-x. 1 wking wking 10240 Jul 12 21:49 bazel-bin/test.tar
```

### What operating system are you running Bazel on?

RHEL 7.5 (Linux).

### What's the output of `bazel info release`?

```console
$ bazel info release
release 0.15.0- (@non-git)
```

### If `bazel info release` returns "development version" or "(@non-git)", tell us how you built Bazel.

Installed from [COPR][2].

### Have you found anything relevant by searching the web?

#2925 is similar, but (as mentioned above), it's about the content of the tarball and not the tarball itself. I didn't see anything on SO or bazel-discuss@.

[1]: https://docs.bazel.build/versions/master/be/pkg.html#pkg_tar
[2]: https://copr.fedorainfracloud.org/coprs/vbatts/bazel/

Start by reproducing the issue with the shown pkg_tar rule and inspect how its output tarball receives mode 0555. Trace the existing mode parameter and determine where an output-mode option would belong; done means the output mode is configurable while preserving reproducible builds and the documented default behavior.

Written by the indexing model from the issue text.