Shell commands

Make allows running arbitrary shell commands during evaluation via the $(shell) function. Currently, we still allow this in the converted Starlark, but plan to remove it before finishing the conversion.

Running arbitrary shell commands makes the build non-hermetic.

Along the same line, don't read or write any files during the product configuration, either through $(shell cat file.txt) or $(file <file.txt). File I/O in Bazel is only supported under certain situations, such as repository rules.