Support configuration to mark an artifact "testonly"

[cgruber]

Bazel supports a "testonly=" flag on most rules, constraining the rules in the following way - a testonly rule can depend on regular and testonly rules, but a regular rule cannot depend on a testonly rule.

This is slightly inverted from Maven, which specifies the purpose of a dep at the point of inclusion (the deps list). Bazel specifies a target itself as testonly. Since tests and production targets are separate nodes in bazel (in maven they're one node with "flavored" deps), this handling has to be different.

This feature would allow the person specifying an artifact in the pinned artifact list as being testonly. e.g.

maven_repository_specification(
    name = "maven",
    artifacts = [
        "junit:junit:4.12": { "sha256": "blah", testonly = True },
    ],
)

Thus, one could not use the @maven//junit from any rule that was not also testonly=true. Test libraries (building test infrastructure) could of course safely mark themselves testonly=true.

This allows bazel to prevent leaking test deps into production code, by complaining loudly at build analysis time.

Note, the whole chain of deps connected up must be testonly, so if this feature is used for, say, Hamcrest (upon which junit relies) then junit must also be so marked. So it is an "infectious" feature. But that's by design.

Implements part of #52