Restrict Starlark to only interact with Starlark types

[c-parsons]

Over the past year or so a number of bugs have arisen from Starlark functions/methods/struct fields returning natives types that are not proper Starlark types.
One concrete example: specifying a license attr (using attr.license()) on a rule and then, from the rule context, calling ctx.attr.license, gets you an object which is not exposed to Starlark.
Trying to print this object prints <unknown object com.google.devtools.build.lib.packages.License>

Starlark needs to crack down on this -- we should throw a catastrophic exception whenever any expression evaluates to a non-Starlark type. Fixing these adhoc only gets us so far, as this sort of bug keeps reappearing.

For motivation as a P1, this particular license bug required me to rollback some progress on #5010. @SkylarkCallable-annotated methods do have return-type validation, and verify that methods return appropriate Starlark types. But struct() does not -- so the following (simplified) user code resulted in a catastrophic error when we migrated getattr to appropriate validation:

mystruct = struct(license = ctx.attr.license)
obj = getattr(mystruct, "license", None):

as getattr would try to return an invalid type.

For license itself, we will need to make a call on whether ctx.attr.license should return nothing or an opaque-but-valid Starlark object.

[laurentlb]

Do you know how much work it is?

[c-parsons]

The work is migrating all remaining uses of @SkylarkSignature to @SkylarkCallable, which should be a very small (< 1 week) amount of implementation work.
However, there may be some migration, which I find hard to estimate duration of.

Next step here is to deal with the implicit rule attribute "distrib", which has no Starlark type, but is assignable in Starlark.

[c-parsons]

Update: The work remaining here is to remove SkylarkSignature from PackageFactory, which is a tricky refactoring. To kill off this SkylarkSignature annotation from Bazel entirely (which would be a great refactoring win), we also need to swap out SkylarkSignature usages in Runtime for another annotation which is no-op except for providing documentation for docgen. (Useful for documenting top-level primitives such as None, True, and False.

[katre]

Downgrading from P1 and sending to be re-triaged.

[brandjon]

I believe this work is mostly done in the interpreter refactoring. Starlark.fromJava() implements the conversion and validation at Java-to-Starlark boundaries, and is called at various places in the interpreter. It may be possible to sneak a bad value through, but more invasive checking (e.g. scanning list elements) likely comes with a performance penalty.