Provide an hermetic toolchain

[Kernald]

First of all, thanks for those rules! My pico should arrive today, I was planning on writing something similar :-)

At the moment, these rules are depending on the platform's arm-none-eabi toolchain. This requires any host machine that will eventually build anything on the repo (even if they're not targeting pico) to have such a toolchain. It would be great having such a toolchain downloaded on demand rather than relying on the host's, e.g. like https://github.com/grailbio/bazel-toolchain is doing for more common architectures!

[dfr]

Clearly adding a hermetic toolchain would help for ensure repeatable builds. Unfortunately, I don't know of a single source for a gcc arm-none-eabi + newlib which covers all the platforms (FreeBSD, Linux, MacOS, Windows).

I have looked at grailbio/bazel-toolchain in the past but this covers just the toolchain whereas the arm-none-eabi packages also have the necessary newlib headers and libs to support pico-sdk.