Add a `java_toolchain` attribute to specify options to the `header_compiler_direct` tool (#375)

Primary motivation is to let users not using the Turbine graal native image silence protobuf sun.misc.Unsafe warnings from the direct header compiler

turbine_direct (header_compiler_direct) bundles protobuf, whose UnsafeUtil calls terminally-deprecated sun.misc.Unsafe methods. On JDK 24+ (JEP 498) the JVM prints a warning for each such call during header compilation:

  WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
  WARNING: sun.misc.Unsafe::arrayBaseOffset has been called by
  com.google.protobuf.UnsafeUtil (.../java_tools/turbine_direct_binary_deploy.jar)

Unlike the Turbine worker, header_compiler_direct does not receive turbine_jvm_opts, and --jvmopt does not reach header-compilation actions, so a toolchain currently has no way to silence these warnings for the direct header compiler. Add --sun-misc-unsafe-memory-access=allow to header_compiler_direct_jvm_opts, gated on the runtime feature version since the flag is rejected on JDK <= 22.

See https://github.com/protocolbuffers/protobuf/issues/20760.

Fixes #374

Closes #375

COPYBARA_INTEGRATE_REVIEW=https://github.com/bazelbuild/rules_java/pull/375 from davido:turbine-direct-unsafe-memory-access da635b6bebb7ac660f19451469182f54adea884c
PiperOrigin-RevId: 968352943
Change-Id: I94d5bc5d564016ced3cc3b6e06330fad4d8451a7

java/common/rules/java_toolchain.bzl

diff --git a/java/common/rules/java_toolchain.bzl b/java/common/rules/java_toolchain.bzl
index a24ae4f..a635c5d 100644
--- a/java/common/rules/java_toolchain.bzl
+++ b/java/common/rules/java_toolchain.bzl
@@ -91,6 +91,9 @@
     else:
         header_compiler_direct_data = []
         header_compiler_direct_jvm_opts = []
+
+    header_compiler_direct_jvm_opts = header_compiler_direct_jvm_opts + ctx.attr.header_compiler_direct_opts
+
     if ctx.attr.oneversion_allowlist and ctx.attr.oneversion_whitelist:
         fail("oneversion_allowlist and oneversion_whitelist are mutually exclusive")
     oneversion_allowlist = ctx.file.oneversion_allowlist if ctx.file.oneversion_allowlist else ctx.file.oneversion_whitelist
@@ -588,6 +591,18 @@
 The list of arguments for the JVM when invoking turbine.
             """,
         ),
+        "header_compiler_direct_opts": attr.string_list(
+            doc = """
+Additional options passed to the direct header compiler, verbatim and without
+location or make-variable expansion.
+
+Warning: these are only meaningful when the direct header compiler runs on a
+JVM, such as TurbineDirect's deploy jar. A native direct header compiler such
+as turbine_direct_graal parses them as Turbine command-line options, so do not
+set JVM options (for example --sun-misc-unsafe-memory-access=allow) when a
+native direct header compiler is in use.
+            """,
+        ),
         "xlint": attr.string_list(
             default = [],
             doc = """