This is almost the same as bazel_8. The differences are:
* Extra args for Darwin are passed by environment variable, since
Bazel 9 is stricter about preventing include flags reaching outside
the repository.
* The Java test is switched to vendor mode, to apply fixups to ijar.
* Various patch changes due to upstreaming and churn.
* --spawn_strategy=local passed for tests on Darwin, otherwise they
fail due to nested sandboxing (this seems to be the case for bazel_8
as well).
* --repo_contents_cache= passed for FOD generation. This is the old
Bazel 8 default, and prevents an error because the contents cache is
not allowed to be within the repository.
* Disabled universal binaries in protobuf on Darwin. This breaks the
build when sandboxed.
* Patched out '/usr/bin/env bash' in generate_system_module_map.sh in
tests, as this breaks under Darwin sandbox.
