Add opt-in transitive package attribution to dependency reachability

[Copilot]

dependency_reachability only emitted direct cross-repo consumers, so downstream users could not attribute an external repository to main-repo packages that reached it through shared internal code. In Envoy this under-attributed extension consumers and made a reverse "extensions: entry is actually used" check unsound.

• Add transitive package attribution, not full intra-repo edge recording

  • Introduce optional attribution_patterns on dependency_reachability.
  • When set, the aspect propagates, per external repo, the set of matching main-repo packages that transitively reach it.
  • Emit this as attributed_packages in the JSON, with:
    • package
    • roots
    • production (false means attribution exists only via testonly paths)

• Keep the default path zero-cost

  • With attribution_patterns = [] / unset:
    • no attribution sets are propagated
    • attributed_packages is omitted
    • existing output remains byte-identical

• Preserve existing reachability semantics

  • Attribution follows the same exclusion behavior as edge traversal:
    • excluded repos are neither recorded nor traversed
    • nothing is attributed through an excluded repo
  • Multiconfig merging uses the existing union model:
    • package roots union
    • package production merges with logical OR
  • Testonly-vs-production remains distinguishable at the package level

• Document the intended downstream usage

  • Update the module docstring to describe:
    • the new attribute
    • the new output field
    • exclusion behavior
    • multiconfig union semantics
    • the opt-in size/cost tradeoff

• Add regression coverage for the attribution shape

  • transitive-only attribution through a non-matching shared package
  • multiple internal hops
  • multiconfig unioning
  • exclusion pruning
  • explicit empty-pattern byte identity
  • testonly-only attribution

Example:

dependency_reachability(
    name = "dep-reachability",
    roots = ["//source/exe:envoy_main_common_with_core_extensions_lib"],
    attribution_patterns = ["//source/extensions/..."],
)

.dependencies["<repo>"].attributed_packages[]
| select(.production)
| .package

This keeps the output sized by the number of relevant packages, not by the full set of intra-repo edges, while giving downstream consumers enough information to attribute external repos transitively.