stdlib: Do not pass -static to cgo (#3593)

* stdlib: Do not pass -static to cgo

The CGO_LDFLAGS we pass get embedded as the cgo_ldflag directive. Once
we pass -static, any cgo/net/os.user usage will lead to linking
statically. Avoid this.

Fixes: #3590

* link: Control static linking through go.mode.static

Control whether or not to link statically through go.mode.static
and not through the C/C++ compiler's ldflags.

This only matters when Go's linker decides to use external linker
for linking the final binary. This started to happen with Go 1.20
as the builder passes `-fdebug-prefix-map=` when building cgo code.

In return the Go compiler emits the preferlinkext hint.

go/private/actions/link.bzl

@@ -78,7 +78,7 @@ def emit_link(
     # Exclude -lstdc++ from link options. We don't want to link against it
     # unless we actually have some C++ code. _cgo_codegen will include it
     # in archives via CGO_LDFLAGS if it's needed.
-    extldflags = [f for f in extldflags_from_cc_toolchain(go) if f not in ("-lstdc++", "-lc++")]
+    extldflags = [f for f in extldflags_from_cc_toolchain(go) if f not in ("-lstdc++", "-lc++", "-static")]
 
     if go.coverage_enabled:
         extldflags.append("--coverage")

go/private/actions/stdlib.bzl

@@ -94,10 +94,11 @@ def _build_env(go):
     # go std library doesn't use C++, so should not have -lstdc++
     # Also drop coverage flags as nothing in the stdlib is compiled with
     # coverage - we disable it for all CGo code anyway.
+    # NOTE(#3590): avoid forcing static linking.
     ldflags = [
         option
         for option in extldflags_from_cc_toolchain(go)
-        if option not in ("-lstdc++", "-lc++") and option not in COVERAGE_OPTIONS_DENYLIST
+        if option not in ("-lstdc++", "-lc++", "-static") and option not in COVERAGE_OPTIONS_DENYLIST
     ]
     env.update({
         "CGO_ENABLED": "1",