build/toolchain/protobuf: fix duplicate protoc build

We were building way too many copies of protoc. Many of these are due to
a bug in rules_go when --incompatible_enable_proto_toolchain_resolution
is enabled, but not all, so we should do this anyway, and then the bug
in rules_go is no longer relevant.

Before:
bazel cquery "deps(//...) intersect @protobuf//:protoc"
@protobuf//:protoc (e5c4511)
@protobuf//:protoc (40d0309)
@protobuf//:protoc (3bbe29a)
@protobuf//:protoc (070fbf5)
@protobuf//:protoc (ee343a7)
@protobuf//:protoc (c3e4ff6)

After:
bazel cquery "deps(//... except //build/toolchain/protobuf/...) intersect @protobuf//:protoc"
@protobuf//:protoc (ee343a7)

Change-Id: I6a826b7bc01453284982204aea808f8f2902d84c
Reviewed-on: https://review.monogon.dev/c/monogon/+/4164
Reviewed-by: Tim Windelschmidt <tim@monogon.tech>
Tested-by: Jenkins CI
diff --git a/build/toolchain/protobuf/BUILD.bazel b/build/toolchain/protobuf/BUILD.bazel
new file mode 100644
index 0000000..19caf61
--- /dev/null
+++ b/build/toolchain/protobuf/BUILD.bazel
@@ -0,0 +1,17 @@
+load("@protobuf//bazel/toolchains:proto_toolchain.bzl", "proto_toolchain")
+load(":def.bzl", "ignore_unused_configuration_target")
+
+ignore_unused_configuration_target(
+    name = "protoc",
+    dep = "@protobuf//:protoc",
+    visibility = ["//visibility:private"],
+)
+
+# This is a copy of the toolchain defined at
+# @protobuf//bazel/private/toolchains:protoc_sources_toolchain, but with unused
+# configurations reset, such that we build protoc only once.
+proto_toolchain(
+    name = "protoc_sources",
+    exec_compatible_with = [],
+    proto_compiler = ":protoc",
+)