feat(rules_download): hermetic `commands`

Allows running commands using hermetically provided binaries:

```py
archive = use_repo_rule("@rules_download//download:defs.bzl", "download_archive")

archive(
    ...,
    commands = {
        "symlink": ["ln", "-s", "abc", "foo"],
    },
)
```