Toolchain config alternative to `--per_file_copt`

### Description of the problem / feature request:

Provide a way to express `--per_file_copt` in the toolchain configuration, as an alternative to putting it in `.bazelrc`.

### Feature requests: what underlying problem are you trying to solve with this feature?

`--per_file_copt` can be used to control warnings from third-party dependencies. For example, `--per_file_copt=external/.*@-w` will silence all such warnings (which is often appropriate, since projects often don't have control over their dependencies' third-party code).

### Have you found anything relevant by searching the web?

Yes. This feature was originally requested here: https://groups.google.com/g/bazel-discuss/c/0zk1csyp4uU

It came up in https://bazelbuild.slack.com/archives/CGA9QFQ8H/p1698699534921939, too.

### Any other information, logs, or outputs that you want to share?

This seems like an important piece of UX for configuring toolchains with strict warnings.