Separate out "pull_tool" binary

[malt3]

We need native Go code during the image pull phase (in a repo rule) and during the build phase (via a Bazel toolchain).
This PR splits out a part of the img tool into a separate binary pull_tool.
The goal is to eventually enable a source bootstrap of the pull tool in a repository rule.
Once everything is done, all parts of the codebase can be used without any prebuilt code (at any commit and with local patches):

• the Bazel rules (via rules_img)
• the img tool (via rules_img_tool)
• the pull_tool (via a new Bazel module)

Working towards #110.

[aspect-workflows]

Bazel 8 (Test)

2 test targets passed

Targets

//img/private/release/gazelle_plugin:release_files_test [k8-fastbuild] 80ms
//util:buildifier.check [k8-fastbuild]                                 974ms

Total test execution time was 1s. 8 tests (80.0%) were fully cached saving 1s.

---

Buildifier