feat: support CUE @embed via data attr on cue_instance and cue_module

[cgrindel]

Summary

• Add a data attribute (allow_files = True) to both cue_instance and cue_module so non-.cue files can be staged alongside a package's .cue files in the Bazel sandbox.
• Motivation: CUE v0.12.0+ supports @embed(file=…) / @embed(glob=…) directives (activated per file with @extern(embed)), which resolve paths relative to the directory containing the referring .cue file. Today cue_instance.srcs is .cue-only (allow_files = [".cue"]), and the existing srcs / qualified_srcs on the output-producing rules are passed to CUE as CLI "packageless file" args (merged into evaluation, not staged as siblings). So @embed directives can't find their targets under Bazel.
• The fix threads declared data files through CUEInstanceInfo.transitive_files and the module-runfiles depset. No changes to cue-run-from-runfiles: Bazel's runfiles tree already places the files at their workspace-relative paths, which mirror the CUE module layout, so CUE's embed interpreter resolves them naturally.
• Module-boundary enforcement (no .. escapes, no symlink escapes) is deferred to CUE at evaluation time rather than duplicated in Starlark — avoids drift from CUE's canonical rules.

Changes

• cue/cue.bzl:
  • CUEModuleInfo gains an external_data_files depset field.
  • cue_module and cue_instance both gain a data = attr.label_list(allow_files = True) attribute.
  • _cue_instance_impl includes ctx.files.data (and the module's external_data_files) in transitive_files.
  • _cue_module_runfiles_impl includes external_data_files in its runfiles depset so module-level data reaches consumers (e.g. cue_exported_files).

Test plan

• `bazel test //...` — 17 / 17 tests pass (14 pre-existing + 3 new embed tests).
• New golden-file integration tests under `test/testdata/embed/`, matching the existing `cue_test` pattern:
  • basic/ — single-file `@embed(file=default.conf.template, type=text)`
  • glob/ — multi-file `@embed(glob=payloads/*.json)` (exercises that the whole package dir is staged, not just one file)
  • transitive/ — `app` depends on `lib`; `lib` embeds a sibling `greeting.txt`. Verifies `data` on a transitive `cue_instance` flows through to the consumer's action inputs.
• Buildifier check on touched files — no formatting changes needed.

Notes

• Attribute naming: chose `data` over a CUE-specific name (e.g. `embed_files`) to match Bazel convention (`py_library`, `sh_library`, `filegroup`) — it's what users grep for, and it also covers any future non-`@embed` reason to co-locate sibling files.
• No automated negative test for "file outside module root" — since enforcement is deferred to CUE, that path produces a CUE runtime error (not a Starlark one). The existing test suite has no `analysistest` usage; keeping it that way for this PR.