Add exec constraints to local Java runtime toolchains

Fixes incorrect behavior in cross-platform build situations where a
local Java runtime would end up in the runfiles of a `java_binary`
target built for a platform on which it can't be executed.

Work towards https://github.com/bazelbuild/bazel/issues#18265
Split off from https://github.com/bazelbuild/bazel/pull/18262