Add --experimental_check_non_output_external_files option

This option disables the code path that checks so-called "non-output
external" files.  Some debugging shows that these are files supplied
by the host, eg. files under /usr/bin/ and files under the install
root.

It's puzzling why files under the install root need to be checked for
changes, as the bazel launcher also checks for timestamp changes, but
I couldn't work out from where these file checks are scheduled, but
requests for information in Bazel slack went unanswered
(https://bazelbuild.slack.com/archives/CEH3YH9RC/p1745491096584379)

Following the example of the
--experimental_check_external_repository_files
--experimental_check_output_files flags, there is no test.

Addresses #25954.

RELNOTES: File change checks for non-output external files (host files
and embedded tools) can now be disabled with the
`--experimental_check_non_output_external_files` flag.

Author: hanwen-flow

src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java

@@ -188,6 +188,15 @@ public ParallelismConverter() throws OptionsParsingException {
               + "previous run's cache.")
   public boolean checkOutputFiles;
 
+  @Option(
+          name = "experimental_check_non_output_external_files",
+          defaultValue = "true",
+          documentationCategory = OptionDocumentationCategory.UNDOCUMENTED,
+          effectTags = {OptionEffectTag.UNKNOWN},
+          help =
+                  "Check for modifications made to the non-output external files (install root, host files)")
+  public boolean checkNonOutputExternalFiles;
+
   /** A converter from strings containing comma-separated names of packages to lists of strings. */
   public static class CommaSeparatedPackageNameListConverter
       extends Converter.Contextless<List<PackageIdentifier>> {

src/main/java/com/google/devtools/build/lib/skyframe/SkyframeExecutor.java

@@ -3567,6 +3567,7 @@ protected WorkspaceInfoFromDiff handleDiffs(
           pathEntriesWithoutDiffInformation,
           options.getOptions(PackageOptions.class).checkOutputFiles,
           repoOptions != null && repoOptions.checkExternalRepositoryFiles,
+          options.getOptions(PackageOptions.class).checkNonOutputExternalFiles,
           fsvcThreads);
     }
     handleClientEnvironmentChanges();
@@ -3643,6 +3644,7 @@ protected void handleDiffsWithMissingDiffInformation(
       Set<Pair<Root, ProcessableModifiedFileSet>> pathEntriesWithoutDiffInformation,
       boolean checkOutputFiles,
       boolean checkExternalRepositoryFiles,
+      boolean checkNonoutputExternalFiles,
       int fsvcThreads)
       throws InterruptedException, AbruptExitException {
 
@@ -3651,7 +3653,7 @@ protected void handleDiffsWithMissingDiffInformation(
         || (checkOutputFiles && externalFilesKnowledge.anyOutputFilesSeen)
         || (checkExternalRepositoryFiles && repositoryHelpersHolder != null)
         || (checkExternalRepositoryFiles && externalFilesKnowledge.anyFilesInExternalReposSeen)
-        || externalFilesKnowledge.tooManyNonOutputExternalFilesSeen) {
+        || (checkNonoutputExternalFiles && externalFilesKnowledge.tooManyNonOutputExternalFilesSeen)) {
       // We freshly compute knowledge of the presence of external files in the skyframe graph. We
       // use a fresh ExternalFilesHelper instance and only set the real instance's knowledge *after*
       // we are done with the graph scan, lest an interrupt during the graph scan causes us to
@@ -3731,7 +3733,7 @@ protected void handleDiffsWithMissingDiffInformation(
       // think the graph needs to be scanned.
       externalFilesHelper.setExternalFilesKnowledge(
           tmpExternalFilesHelper.getExternalFilesKnowledge());
-    } else if (!externalFilesKnowledge.nonOutputExternalFilesSeen.isEmpty()) {
+    } else if (checkNonoutputExternalFiles && !externalFilesKnowledge.nonOutputExternalFilesSeen.isEmpty()) {
       logger.atInfo().log(
           "About to scan %d external files",
           externalFilesKnowledge.nonOutputExternalFilesSeen.size());