cmd/go: Don't prefer external linking when using bazel

The -fdebug-prefix-map= option is passed by bazelbuild/rules_go
when building cgo code. This option impacts the generation of the
debug symbols but has no effect on linking. Add it to the allow-list
to not prefer external linking.

Fixes: #60865

Author: Holger Hans Peter Freyther

src/cmd/go/internal/work/security.go

@@ -59,6 +59,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{
 	re(`-f(no-)builtin-[a-zA-Z0-9_]*`),
 	re(`-f(no-)?common`),
 	re(`-f(no-)?constant-cfstrings`),
+	re(`-fdebug-prefix-map=(.+)`),
 	re(`-fdiagnostics-show-note-include-stack`),
 	re(`-f(no-)?eliminate-unused-debug-types`),
 	re(`-f(no-)?exceptions`),

src/cmd/go/testdata/script/cgo_suspect_flag_force_external.txt

@@ -55,6 +55,9 @@ stderr preferlinkext
 env CGO_CFLAGS=-fprofile-instr-generate
 go build -x -n -o dummy.exe ./usesInternalCgo
 stderr preferlinkext
+env CGO_CFLAGS=-fdebug-prefix-map=/some/sandbox/execroot/workspace=/tmp/new
+go build -x -n -o dummy.exe ./usesInternalCgo
+! stderr preferlinkext
 env CGO_CFLAGS=
 
 [short] skip