Bazel: debug info embeds absolute paths into the sandbox

If you build with `-g` or `-gseparate-dwarf`, the generated symbols will contain absolute paths into Bazel's sandbox directory. Those directories don't exist beyond the lifetime of an individual compile action, so the resulting debug symbols aren't useful. For example, you won't be able to [debug using Chrome Developer Tools](https://developer.chrome.com/blog/wasm-debugging-2020/).

The way that Bazel toolchains usually address this is one of the following:
* Execute the compile action in an environment that sets `$PWD` to `/proc/self/cwd`. [This is what the default Bazel cc toolchain does on linux.](https://github.com/bazelbuild/bazel/blob/f2b2cde503ec25ab12ebc99afcb9ae73c64de617/src/main/java/com/google/devtools/build/lib/rules/cpp/CppCompileAction.java#L874-L876)
* Set an appropriate `-fdebug-prefix-map` flag in a compiler wrapper script. [This is what the default Bazel cc toolchain does on macOS.](https://github.com/bazelbuild/bazel/blob/3451774a8a76b8ef9211e852ec3173498bbac1a7/tools/osx/crosstool/wrapped_clang.cc#L317-L319)