fix(bazel): shimmed sha2-asm cc flags for zig cross toolchains

- The aarch64 asm feature added for #9554 broke //:natives-linux-arm64: sha2-asm's build script passes cc-rs's rust-style --target triple (the zig launcher appends its glibc suffix, yielding the invalid 4-part 'aarch64-unknown-linux-gnu.2.17') and a hardcoded -march=armv8-a+crypto that zig parses as its own cpu+feature syntax ('unknown CPU: armv8').
- Added a CC_<triple> shim scoped to the zig-built linux aarch64 triples that drops --target (the launcher injects the correct -target) and rewrites -march to assembler-scoped -Wa,-march (zig -mcpu features never reach .S assembly jobs).
- Verified //:natives-linux-arm64 and //:natives-linux-musl-arm64 build; darwin builds use the host Xcode toolchain and never see the shim.