Bug: android_library neverlink leaks native code (and maybe more?)

### Description of the problem / feature request:

[android_library has a neverlink option](https://docs.bazel.build/versions/master/be/android.html#android_library.neverlink). Neverlink is supposed allow the library use the library during compilation but not bundle it or its dependencies into the APK--analogous to the (better named?), option [cc_import.system_provided](https://docs.bazel.build/versions/master/be/c-cpp.html#cc_import.system_provided). From the (linked) android_library docs:

> Only use this library for compilation and not at runtime. The outputs of a rule marked as neverlink will not be used in .apk creation. Useful if the library will be provided by the runtime environment during execution.

However, some files leak through neverlink and are bundled into the APK.

As an example, .so files from android_libraries JNI code are bundled into the final APK, regardless of neverlink.

The following TODO makes me wonder if the issue is resources more broadly? Can't see the Buganizer details bc I'm (no longer) a Googler.
https://github.com/bazelbuild/bazel/blob/f9db4fb91bf62a831e73bf09431619a361f0fcc5/src/main/java/com/google/devtools/build/lib/rules/android/AndroidLibrary.java#L138

Neverlink does, however, work for Java code--at least judging from the change in dex size. I'm wondering if, perhaps, neverlink got brought over form java_library, but wasn't properly generalized to android_libraries?

### Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Just grab the [NDK example](https://docs.bazel.build/versions/master/android-ndk.html), add neverlink, and give it a go.

### What operating system are you running Bazel on?

macOS

### What's the output of `bazel info release`?

4.0.0