feat(zipapp): add content hash support to __main__-based invocations

[rickeylev]

This adds support for zipapps going through __main__ to extract to a directory
based on their content hash. This matches behavior of the shell-based
self-executable bootstrap.

[gemini-code-assist]

Code Review

This pull request introduces a content-based hashing mechanism for zipapp extraction directories to ensure uniqueness. It replaces the standard template expansion with a custom zip_main_maker tool that computes a SHA256 hash of the application's runfiles and injects it into the __main__.py template. Feedback highlights a bug in the template substitution logic where overlapping placeholder names could cause incorrect replacements, and suggests refactoring duplicated manifest-building logic in the Starlark rules.

[aignas]

LGTM